statamic-mcp

The custom 'Bearer token' authentication method, which is essentially a base64-encoded email and password, is not a true secure token and is functionally equivalent to basic authentication. If the API endpoint is not exclusively served over HTTPS, this could expose credentials in plain text. The BaseStatamicTool explicitly states it uses 'permissive' argument validation for 'Claude compatibility', which means complex, potentially malicious data structures in arguments might not be fully validated at the base level, relying heavily on individual router implementations for deeper input sanitization. While there are strong positive security features like the `PathValidator` for file operations, whitelisted configuration access for system tools, and robust audit logging with sensitive data redaction, these concerns regarding authentication and base-level input validation are significant.