youtrack-mcp

The server uses environment variables for YouTrack URL and token, and implements OAuth2 with PKCE, storing tokens securely in `~/.youtrack-mcp-auth.json`. A critical security feature is strict project scoping: if `PROJECT_ID` is set in the environment, the server *enforces* this project for all tool calls, overriding any `projectId` provided by the AI, thus preventing unauthorized cross-project access. Input parameters are validated extensively using `ParameterValidator`. Content sanitization is applied for descriptions and comments. The `commands` tool exposes YouTrack's powerful command-line API to the AI via its `/commands` endpoint, which requires careful management of the YouTrack permanent token's permissions to prevent unintended actions within YouTrack itself. The `remote.ts` component exposes an SSE endpoint, but sessions are managed. No `eval` or direct system command execution from AI input was identified.