clara-mcp-server

Critical path traversal vulnerability exists in the `agent.analysis` tool. The `file_path` parameter, if an AI agent can control its value without sanitization, allows reading arbitrary local files from the server's filesystem and subsequently uploading them to the backend Clara API. This presents a severe risk of data exfiltration or unauthorized access to server resources. Additionally, the server uses global mutable variables (`app.data.user_id`, `app.data.api_key_token`) for authentication context. In a concurrent environment, these global variables could be overwritten by a different request during processing, potentially leading to incorrect or leaked credentials being used by a request. The default `log_level` for Uvicorn is set to 'error', which may hinder effective security incident detection and debugging.