mcp

The project demonstrates strong security practices, including a dedicated `SECURITY.md` outlining vulnerability reporting and best practices. It uses standard authentication mechanisms (Bearer tokens, OAuth2), explicitly warns against hardcoding API keys, and redacts authorization headers in logs. The server implements middleware for authentication, request tracing (Datadog APM), and error reporting (Sentry). Input parsing for tool arguments is type-safe, reducing injection risks. A whitelist of MCP methods can bypass authentication for necessary initialization/discovery. The STDIO server can be run in a `-read-only` mode for enhanced safety.