mcp-tiny-erp-server

CRITICAL: The server explicitly decodes JWT tokens without signature validation, stating 'Decodifica JWT manualmente (sem validação de assinatura)'. This means an attacker could forge JWTs containing any tenant_id and tiny_token, bypassing authentication if they know the payload structure. HIGH: CORS is set to `allow_origins=['*']`, which is a significant security risk for production environments as it allows any domain to make cross-origin requests. MEDIUM: The `mcp_filtro_clientes_excel` tool relies on a hardcoded CSV path (`/mnt/user-data/uploads/contatos_teste.csv`), which could lead to file system vulnerabilities if not properly secured.