mcp-server-oauth2

Multiple critical security risks for production environments are present. Hardcoded credentials for Keycloak (admin/admin), MinIO (minioadmin/minioadmin123), PostgreSQL (meta/metapass, vector/vectorpass), and the OAuth2 client secret ('secret') are found in `docker-compose.yml`, `keycloak/realm-config.json`, and initialization scripts. Additionally, SSL certificate verification is explicitly disabled across `mcp-server`, `mcp-client`, and `gateway-server` for development convenience with self-signed certificates. While these are documented as development-only practices, they represent significant vulnerabilities if deployed without modification. CSRF protection is disabled for API services, which is common with JWTs but should be noted. Fine-grained authorization with `@PreAuthorize` is a positive aspect for internal access control.