sky-pii-mcp

The server demonstrates strong security practices for an integration point. It avoids hardcoded secrets by expecting credentials via environment variables or request parameters. It robustly extracts and validates the *format* of credentials (JWT bearer token vs. API key), passing them securely to the Skyflow SDK. Crucially, it creates new, isolated Skyflow SDK instances and MCP transports for each request, preventing request ID collisions and cross-request data leakage. Input payload size is limited to 5MB, mitigating certain denial-of-service vectors. No 'eval' or obfuscation is present. The only minor point for consideration is the optional fallback of API key via query parameter, which is generally less secure than header-based authentication.