grocy-mcp

The server uses a fully open CORS policy (`allow_origins=["*"]`), which is explicitly mentioned as being for 'browser-based MCP Inspector'. While this might be acceptable for a strictly local and isolated development/testing environment, exposing a server with such a permissive CORS policy to any network, especially the internet, presents a significant security risk. It could enable Cross-Site Request Forgery (CSRF) or data exfiltration from other websites. The authentication mechanism using Home Assistant's ingress session tokens and Grocy API keys from environment variables is good practice for credential management, but the open CORS undermines overall security for broader deployment. Errors from the Grocy API are also logged in detail, which could potentially expose sensitive information if not handled securely in production logs.