totp-mcp-server

No clear evidence of classic supply-chain malware (no obfuscation, no dynamic execution, no network exfiltration, and no destructive behavior). However, this module intentionally issues live TOTP codes via an MCP interface, which is a high-impact security capability and becomes a significant threat if the MCP transport/authorization is weak. Additional concerns include audit-log metadata exposure and an unsanitized file-path construction for the account name in the file backend (mitigated in practice by the membership check against stored_accounts()).