generic_mcp_server

The server dynamically routes client-provided arguments to external `run_url`s defined in Firestore. This poses a significant Server-Side Request Forgery (SSRF) risk if untrusted parties can modify the Firestore tool registry or if `run_url`s are not strictly whitelisted and validated internally by the server. Without robust input validation and whitelisting of `run_url`s, this architecture could allow an attacker to probe internal networks or exfiltrate data by registering malicious tool endpoints. Session management is in-memory, leading to non-persistent sessions and potential integrity issues on server restarts. No explicit authentication/authorization for the MCP endpoint itself is provided, making it an open gateway to registered tools.