wawapp-mcp-debug-server

The server explicitly enforces a 'strictly read-only' guarantee across all tools. It implements robust security features including token bucket rate limiting (per-tool and global), PII masking for sensitive data (phone numbers, names, GPS coordinates), and comprehensive audit logging for all tool executions with sanitized parameters. Input validation uses Zod schemas, and errors are normalized to prevent exposing internal details. It runs as a StdioServer, meaning it communicates via standard input/output rather than exposing network ports, reducing direct attack surface. The documentation explicitly recommends using read-only Firebase roles ('datastore.viewer', 'logging.viewer'). No 'eval' or similar dangerous patterns were found.