esa-mcp-server

The server securely handles credentials by requiring the `ESA_ACCESS_TOKEN` via environment variables. Input validation is robustly implemented using Zod schemas for all tool parameters, significantly reducing common injection vulnerabilities. Attachment handling (`esa_get_attachment`) is implemented with security in mind, offering base64 encoding only for small, supported image types and returning signed URLs for other files or larger images, thus avoiding direct file serving risks. No usage of `eval`, code obfuscation, or other direct malicious patterns were detected. Minor logging is done via `console.error`, which is acceptable but could be replaced with a more structured logging solution for high-volume production environments.