aws-lambda-mcp

The project demonstrates strong compile-time security measures with `Cargo.toml` lints (`unsafe_code = "deny"`, `unwrap_used = "deny"`, `expect_used = "deny"`, `panic = "deny"`), promoting robust and safe Rust code. While `jsonwebtoken::dangerous::insecure_decode` is used in the interceptor, it's contextually acceptable as the architectural diagram indicates full JWT validation (OIDC) occurs upstream at the Bedrock Gateway; the interceptor's role is specifically for claim extraction and expiry checking. Configurable logging levels allow balancing operational visibility with sensitive data protection. Adherence to least privilege for IAM roles, HTTPS for external API calls, and explicit guidance against hardcoding secrets further bolster security.