jsboige-mcp-servers

The server securely retrieves GitHub Personal Access Tokens (PATs) from environment variables (e.g., GITHUB_TOKEN, GITHUB_PAT, GITHUB_ACCOUNTS_JSON), minimizing hardcoding. It enforces explicit security features like a read-only mode (GITHUB_PROJECTS_READ_ONLY) and a repository access whitelist (GITHUB_PROJECTS_ALLOWED_REPOS). GraphQL queries are constructed using variables, which generally prevents injection attacks. While some internal argument parsing uses regex, it is applied to structured MCP tool inputs rather than direct, unsanitized user input. Logging to files (`winston`) is configurable and defaults to stderr in non-production, but care should be taken in production environments to secure log files to prevent exposure of sensitive information.