mcp-server

The server implements a standard JSON-RPC protocol over stdin/stdout. It uses official Go SDKs for GitHub and Notion, and a standard HTTP client with basic authentication for Jira. Configuration loads sensitive API tokens from environment variables or local files, advising against committing them. There is no usage of 'eval' or other dynamic code execution from user input, reducing code injection risks. The `run-docker-mcp-debug.sh` script logs stdin to `/tmp/mcp-debug.log` for debugging purposes, which could expose sensitive command arguments if the log file were publicly accessible, though in its intended context (local debugging) this is typically not a vulnerability. Overall, the architecture and implementation demonstrate reasonable security awareness for an integration server.