tuneit-mcp

The server loads OpenAI API key from environment variables, preventing hardcoded secrets. Filename sanitization is implemented to mitigate directory traversal risks for saved files. The output directories are fixed relative to `OUTPUT_DIR`. The `save_tailored_resume_as_pdf` function uses `pypandoc`, which relies on an external `pandoc` executable. While `pypandoc` is designed for safe usage, any external process invocation introduces a dependency on the security of that external tool and the system environment, though the arguments passed are static and content is AI-generated, reducing direct injection risk. No 'eval' or direct shell command execution from user input is observed.