consult-user-mcp

The PWA component (`ios-pwa`) uses an in-memory store for questions and subscriptions (`api/lib/store.ts`). This is explicitly noted as for 'demo' purposes and is not production-ready. It leads to data loss on restarts/scaling and lacks proper session authentication, making it vulnerable to session hijacking and unreliable for any persistent or multi-user scenario. The macOS component uses `child_process.execFile` to invoke a Swift CLI for native dialogs, which is generally safer than arbitrary shell execution but still relies on the integrity of the CLI binary. No obfuscation or obvious malicious patterns were found. The VAPID keys for push notifications are expected to be environment variables, which is good practice, but the in-memory store remains a critical flaw.