temporal-mcp

The server primarily acts as a proxy to an external Vreme Time API (defaulting to https://api.vreme.ai). While API calls are made over HTTPS, the security and reliability of this external service are critical dependencies outside the scope of this source code analysis. The server uses `StdioServerTransport` for communication with MCP clients, which typically involves standard I/O and does not inherently expose network ports. Input validation for tools is implemented using Zod schemas. Local activity context is stored in a file (`~/.vreme/temporal-context.json`), which could be sensitive depending on user interaction patterns, but no direct filesystem vulnerabilities or hardcoded secrets were identified. No `eval` or obvious obfuscation patterns were detected.