mcp-catalog-server

The server hardcodes MongoDB credentials ("mongo:mongo") and connection details ("localhost:27018") in `src/config/db.ts`. Crucially, it does not use environment variables (e.g., `process.env.MONGO_URI`) for database connection, even though `docker-compose.yml` attempts to set `MONGO_URI`. This means the application, as written, will always try to connect with the hardcoded, weak credentials and specific host/port, regardless of environment variables, posing a severe vulnerability for any non-local deployment. The `docker-compose.yml` also has a mismatch in MongoDB port (`27017` in compose, `27018` hardcoded in code) and host (`db` in compose, `localhost` hardcoded in code), which would prevent the server from connecting to the database in the provided Docker setup without code modification.