public-api-mcp-application

CRITICAL: The backend uses a hardcoded fallback JWT_SECRET 'devsecret' if the `JWT_SECRET` environment variable is not explicitly set. This is a severe vulnerability that makes the authentication easily bypassable. JWT tokens are stored in the browser's localStorage, which is susceptible to Cross-Site Scripting (XSS) attacks if other parts of the frontend are vulnerable. While the frontend uses `ReactMarkdown` with `rehype-highlight` for rendering LLM responses, direct streaming of potentially untrusted LLM output from the MCP to the client could theoretically pose risks if the markdown rendering or sanitization is not robust against all forms of injection, though `ReactMarkdown` typically offers good default protection.