mcp-reference-server

The server implements strong input validation using Zod and JSON Schema. It includes DoS protection for HTTP (body size limit) and stdio (line length limit). OAuth and PKCE implementations use Node.js crypto's timing-safe comparisons. JWT signature verification uses the `jose` library. However, the default HTTP transport configuration allows all CORS origins (`allowedOrigins: ['*']`), which is explicitly marked as 'not recommended for production' and poses a significant security risk if deployed without proper configuration. Additionally, the client-side CLI uses `shell-quote` to parse server commands, which, while safer than simple splitting, can still be a vector for command injection if '--server' arguments are not fully trusted.