Slack_mcp_server

Session tokens are passed via URL query parameters for MCP endpoints and the /auth/me endpoint, which is less secure than HTTP headers and risks exposure in logs or browser history. The server lacks explicit rate limiting for authentication and API endpoints, potentially allowing brute-force attacks. Database table creation is handled on application startup (`Base.metadata.create_all`), which is convenient for development but often considered less robust for production deployments compared to dedicated database migration tools (like Alembic, which is present but not configured for autogeneration in the truncated env.py).