mcp-server-worker

The code acts as an HTTP adapter for the MCP protocol, directly handling 'tools/list' and 'tools/call' methods. User input for search 'query' is passed to Workers AI for embedding and then to Vectorize. The 'topK' parameter for search results is explicitly capped at 10, preventing excessive resource consumption. CORS is broadly enabled ('Access-Control-Allow-Origin: *'), which is common for public APIs but could be restricted further if needed. While the README suggests adding authentication as a production enhancement, the core worker logic itself does not implement it by default, meaning the API is publicly accessible post-deployment. No 'eval' or other obvious code injection vulnerabilities were found in the provided source.