irods-mcp-server

The server uses `Access-Control-Allow-Origin: *` for CORS, which is very broad and could be a security concern if not mitigated by external proxies/firewalls. Logging is configured to report caller information (`log.SetReportCaller(true)`), which may expose sensitive file paths in logs if not configured differently for production environments. While `service_url` supports HTTPS, the server itself does not strictly enforce it, relying on deployment configuration. Basic authentication transmits credentials (which could be base64 decoded) and relies on the underlying HTTP transport for security (e.g., HTTPS). OAuth2/OIDC support adds a robust authentication layer but requires careful configuration of client ID/secret and discovery URLs. Hardcoded credentials for Keycloak are for a development setup only, not for iRODS access.