redmine-mcp-server

The server uses `zod` for robust input validation on all tool arguments, significantly reducing the risk of injection attacks. Sensitive API keys and credentials are handled via environment variables and are not hardcoded. SSL certificate verification and custom CA certificates are supported, enhancing secure communication. The `fs.readFileSync` for `REDMINE_CA_CERT` reads a local file path, which could theoretically be abused if an attacker could control the environment variable; however, this is a standard configuration pattern and not a direct vulnerability in the code itself. Debug logging can expose tool arguments, but this is a configurable log level for development purposes.