mcp-zap-server

The project demonstrates strong security practices: it implements flexible authentication modes (API Key, JWT with refresh and blacklist), enforces robust URL validation to prevent scanning of internal/private networks and localhost by default, and mandates strong secret keys for JWT. CSRF protection is intentionally disabled with clear justification, as it's an API-only server using header-based token authentication (not cookies), aligning with OWASP API security best practices. There are no hardcoded secrets in the source code; sensitive configurations are loaded via environment variables, with 'changeme' defaults for development. Explicit warnings are provided for using 'none' security mode in production.