metoro-mcp-server

The server uses standard Go libraries for HTTP requests and JSON processing. Authentication is handled via METORO_AUTH_TOKEN environment variable, which is good practice. Input arguments for tools are defined via Go structs with JSON schema tags, mitigating direct injection risks. The `CalculateTimeRange` utility includes a check to prevent excessively long queries (over 30 days) in a production environment. There are no `eval` or similar dynamic code execution functions identified. Response sizes are limited for profiles and logs to prevent resource exhaustion. As an API client, its security profile is also dependent on the security of the remote Metoro API it interacts with.