mcp-devkit-server

The server securely handles `MAPBOX_ACCESS_TOKEN` via environment variables and validates all tool inputs using Zod schemas to mitigate common injection risks. External HTTP requests are managed through a robust `HttpPipeline`. Public Mapbox access tokens (pk.*) are embedded in URLs generated by `geojson_preview_tool`, `preview_style_tool`, and `style_comparison_tool` for client-side visualization, which is standard for these APIs but means the token is publicly exposed in the generated URLs. There are no `eval` or similar dangerous patterns detected. The parsing of `OTEL_EXPORTER_OTLP_HEADERS` from environment variables, if controlled by a malicious actor, could pose a risk, but this is an operational configuration, not exposed to runtime user input.