The-Brain

The HTTP API relies on `x-org-id`, `x-user-id`, `x-user-role`, and `x-project-id` headers for multi-tenancy context. If these headers are missing, hardcoded default values (`org-001`, `user-admin-001`, `admin`, `proj-001`) are used. This header-based authentication/authorization is highly susceptible to spoofing if the API is exposed to untrusted networks, allowing unauthorized access to data across different tenants or users. The `requireAdmin` function similarly relies solely on a header value. While prepared statements prevent SQL injection, the lack of robust authentication/authorization for multi-tenancy makes it unsafe for public deployment without an external security layer. The STDIO server uses fixed default context, acceptable for local desktop use but not for exposed scenarios. CORS is enabled globally without specific origin restrictions, posing a risk if deployed publicly. Error messages could potentially leak internal details.