harvest-mcp-server

The server demonstrates strong security practices. It uses Zod for comprehensive input validation on all tool arguments, significantly reducing the risk of injection attacks or malformed requests. Sensitive API credentials (Harvest Access Token and Account ID) are strictly loaded from environment variables, preventing hardcoding. Error handling is well-structured, wrapping exceptions in MCP-compliant error responses to prevent sensitive information disclosure. Dependencies like Axios, Express, Winston, and Zod are reputable. An optional API key authentication is available for the HTTP transport, which is a good security layer, although not mandatory by default for HTTP.