ChatBot-MCP

The `src/services/authService.js` file contains a hardcoded default `cookieId` ('65921143afdf8e07dbf16189') which is used if `localStorage` doesn't provide one. This ID is crucial for authentication with MCP and server memory services, and hardcoding a default authentication identifier is a significant security vulnerability, potentially allowing unauthorized access or session hijacking if not properly managed or if the backend accepts this default as valid for multiple users. Additionally, while `JSON.parse` itself is not inherently dangerous, its extensive use on `toolCall.function.arguments` (from AI responses) and extracted user message values (`extractValueFromMessage`) requires rigorous server-side validation on the MCP service to prevent malformed JSON inputs from causing unexpected behavior or denial of service.