todoist-mcp-lite

The server's design is minimal and adheres to functional principles, reducing attack surface. It uses standard `node-fetch` for network requests and handles API tokens via environment variables or CLI flags, preventing hardcoding. The direct API passthrough nature means it doesn't process user input for shell commands or SQL injection, relying on the robustness of the Todoist API itself. Communication is via Stdio, suitable for local execution as a child process. The only minor point is the use of `node-fetch` v2.x, which is an older major version, but its usage here for simple requests doesn't expose significant known vulnerabilities.