opsorch-mcp

The server's core functionality is explicitly read-only, which significantly reduces the attack surface for data manipulation. It uses environment variables for sensitive configurations like `OPSORCH_CORE_URL` and `OPSORCH_CORE_TOKEN`, which is a good practice. The HTTP transport includes configurable CORS (`MCP_HTTP_ALLOW_ORIGINS`) and Host header allow-lists (`MCP_HTTP_ALLOW_HOSTS`), enhancing network security for remote clients. Input validation is performed using `zod` schemas before making calls to the OpsOrch Core. There are no direct uses of `eval` or similar dangerous functions. The default `OPSORCH_CORE_TOKEN='demo'` for local development is a minor concern if not changed for production but is clearly documented. Overall, the code appears robust against common web vulnerabilities, relying on the security of the underlying 'OpsOrch Core' for data integrity.