paymo-mcp

The code follows good security practices by storing the API key in a separate, sensitive configuration file (`~/.mcp-auth/paymo/auth.json`) rather than hardcoding it or relying solely on a main config. It uses `yaml.safe_load` for parsing YAML input, mitigating YAML injection risks. API requests are made over HTTPS, and basic rate limiting handling with retries is implemented. Descriptions for CSV exports are cleaned of HTML tags and entities. No 'eval' or other obviously dangerous functions are used without strong justification. File system interactions are limited to config files, temporary files for YAML processing, and user-specified output directories for CSV exports, or an optional file_path for expense uploads, all within reasonable bounds for the application's functionality.