stoic-mcp

The server uses `StdioServerTransport` for communication, which is safer than direct network exposure. AI API key (`DEEPSEEK_API_KEY`) is retrieved from environment variables, which is good practice. Tool arguments are type-cast and processed in a controlled switch statement, reducing direct code execution risks. The `import-quotes.ts` utility takes a filename from process arguments, but uses `path.join` with a fixed base directory (`quotes-source/`), which mitigates simple path traversal attacks to write arbitrary files outside the intended directory. AI prompts are constructed with user content, which is sent to an external API but not executed locally, presenting a minor prompt injection vector at the DeepSeek API level.