pierre_mcp_server

The server is built with Rust, leveraging its memory safety features. It implements robust authentication (JWT, API Keys with constant-time comparison) and authorization. A two-tier key management system protects sensitive data at rest using AES256-GCM encryption with Additional Authenticated Data (AAD) for tenant/user isolation. OAuth2 flows include PKCE with S256 method enforced and atomic consumption of authorization codes/states to prevent replay and CSRF attacks. PII redaction is built into the logging middleware. Redirect URIs are strictly validated (HTTPS, no wildcards, no fragments). Client secrets are hashed using Argon2. No 'eval' or obvious malicious patterns found.