aran-mcp

The project aims for high security with detailed threat modeling (SAFE-MCP) and features like tool attestation and anomaly detection. However, several critical implementation gaps exist: (1) The default API key in `backend/internal/middleware/production.go` is a hardcoded placeholder, requiring manual override for production. (2) MCP API routes in `backend/cmd/server/main.go` are explicitly unprotected by default for testing, posing a significant risk if deployed without enabling the `ENABLE_MCP_AUTH` flag. (3) The cryptographic verification for tool attestation in `backend/internal/mcp/tool_manager.go` is stubbed, weakening the integrity checks. (4) The example `mcp-server` component is intentionally vulnerable to path traversal for demonstration purposes, which should not be used in a real environment without proper hardening.