MCP_Server_with_http_OAuth_stdio

The server implements OAuth 2.0 client credentials flow for its HTTP API, including token registration, generation, and validation with expiration. All HTTP API calls are authenticated. The STDIO server, intended for local MCP clients like Claude Desktop, allows for optional token-based authentication during initialization; if no token is provided, requests are processed unauthenticated. While this is justified by its 'local process' use case in the documentation, it means the STDIO server is effectively unsecured unless manually configured with a token. There are no direct 'eval' or arbitrary code execution patterns identified from user input. Employee data and OAuth tokens are stored in local JSON files.