mcp-test

The server correctly uses parameterized queries via the `mysql2` library, which is crucial for preventing SQL injection vulnerabilities. However, the handling of `password_hash` in `addUser` and `modifyUser` is ambiguous; the server directly stores the received hash without explicitly demonstrating strong server-side hashing (e.g., bcrypt, scrypt) and salting. If plain text passwords or weakly hashed passwords are sent from the client, they would be stored as such, posing a significant risk. Additionally, the server uses open CORS (accepts requests from any origin), which can be a security risk in production environments if not restricted to specific trusted origins.