MCP-SERVER-OPENPROJECT

The server uses FastAPI with secure practices like `secrets.compare_digest` for HTTP Basic Auth. Rate limiting, configurable CORS, and GZIP compression are implemented. Critical secrets like `OPENPROJECT_API_KEY` are loaded from environment variables. Potential risks include: 1. Default `HTTP_AUTH_PASSWORD` is set to 'changeme' in deployment files (`docker-compose.yml`, `easypanel-compose.yml`). In `easypanel-compose.yml`, `HTTP_AUTH_ENABLED` defaults to `true`, making this a severe vulnerability if the password is not updated in production. The `install.sh` script mitigates this by prompting for a password and enabling auth. 2. Default `CORS_ORIGINS='*'` allows all origins, which should be restricted to specific domains in production environments. 3. The service exposes HTTP without SSL/TLS by default; documentation advises using a reverse proxy for HTTPS.