ayunis-legal-mcp

The project demonstrates strong security awareness, with explicit input validation (regex for legal codes, length limits), request size limits, and a global exception handler that hides details in production. Database interactions use SQLAlchemy ORM to prevent SQL injection. A comprehensive `SECURITY.md` outlines best practices for deployment. However, it explicitly states current limitations for a public API: no rate limiting (vulnerable to DoS) and no authentication, which are critical for public-facing deployments. The default `POSTGRES_PASSWORD` and empty `OLLAMA_AUTH_TOKEN` in configuration require user attention for production. The basic X-Token validation is noted as a simple example, not production-ready.