cardpilot-remote-mcp-server

The server exposes two tools, 'get-cards' and 'get-guides', both of which fetch data from a hardcoded external AWS API endpoint (https://fqrqqph16l.execute-api.us-west-2.amazonaws.com). While the parameters for 'get-cards' are validated using Zod, the system relies entirely on the security and data integrity of this external API. The server uses permissive CORS headers ('Access-Control-Allow-Origin: *'), which is standard for public APIs but means no origin-based access control is enforced at this layer. No 'eval' or obvious hardcoded secrets beyond public API endpoints were found.