omise-mcp

The server demonstrates strong security practices including explicit tool-level access control via the 'TOOLS' environment variable, which is mandatory for startup. It validates all incoming parameters for API calls, significantly reducing attack surface. Sensitive data like API keys, passwords, and card numbers are actively masked in logs using `sanitizeHeaders` and `sanitizeBody` functions. The Docker configuration enforces hardened practices like running as a non-root user, using `no-new-privileges`, `read_only` file systems, and `tmpfs` for temporary directories. The `OMISE_SECRET_KEY` is externalized and validated for environment consistency (e.g., preventing live keys in test mode). Comprehensive error handling and logging (with redaction) are in place. No 'eval' or obvious obfuscation found.