fcai-mcp-servers

The server loads OpenAPI specifications and security configurations from local JSON files (`openapi.json`, `security.json`) at runtime. These files are expected to be generated during deployment from base64-encoded parameters (`OPENAPI_SPEC_BASE64`, `OPENAPI_SECURITY_CONFIG_BASE64`). The security of the deployed server heavily depends on the integrity and trustworthiness of these input specifications and how sensitive information (like API keys in `security.json`) is handled by the deployment platform. The `publish.yaml` does not explicitly mark `OPENAPI_SPEC_BASE64` or `OPENAPI_SECURITY_CONFIG_BASE64` as sensitive parameters, which could be a concern if they contain secrets that are not appropriately protected during the deployment process or at rest. No direct `eval` or remote code execution vectors are apparent in the provided Node.js source code.