opus-mcp

The server utilizes environment variables for sensitive configurations (S3 credentials, proxy settings), which is good practice and avoids hardcoded secrets. It explicitly warns about and provides flags (`OPUS_MCP_INSECURE_SKIP_VERIFY`, `OPUS_MCP_S3_INSECURE_SKIP_VERIFY`) to disable TLS/SSL certificate verification, clearly labeling them as insecure for production use. Input arguments for MCP tools are validated against JSON schemas using `jsonschema-go`, enhancing robustness against malformed inputs. A rate limiter is implemented for arXiv API calls to comply with their terms of use. Proxy URLs are sanitized before logging to prevent credential exposure. However, CORS is set to allow `*` (`Access-Control-Allow-Origin: *`), which is permissive and should ideally be restricted to specific origins in a production environment for better security.