rs-mcp-agent

Uses Keycloak OIDC for modern authentication, but also supports legacy username/password authentication directly with ReportServer, which may be less secure depending on the specific implementation and threat model. `ClientSecret` values are placeholders (empty strings) in configuration files; these must be replaced with actual secrets, ideally from environment variables, for production deployments. `AllowedHosts: *` is used in the production `appsettings.json`, which should be restricted to specific domains. `RequireHttpsMetadata: false` is set in development configurations, requiring careful consideration to enable HTTPS in production. Cross-origin iframe monitoring for authentication is a standard pattern but relies on proper configuration of the authentication provider to prevent issues. The project references Playwright installation scripts that employ `sudo` and `curl | bash` patterns, which carry inherent risks if the source is not fully trusted.