ekkos-mcp-server

The primary server file (`index.ts`), which is compiled and distributed, is designed as a secure proxy. It retrieves `EKKOS_API_KEY` and `EKKOS_USER_ID` from environment variables and makes authenticated HTTPS requests to the remote ekkOS API (`mcp.ekkos.dev`). It explicitly states 'NO direct database access.' This is a robust and secure pattern for a local proxy. However, the repository contains an excluded `index-legacy.ts` file. This file, if compiled and run, would directly connect to a Supabase database using a `SUPABASE_SECRET_KEY` (or `MEMORY_API_TOKEN`) sourced from environment variables. Exposing a Supabase secret key in a client-side binary is a critical security vulnerability, as it typically grants full read/write access to the entire database. While `tsconfig.json` explicitly excludes `index-legacy.ts`, its mere presence in the source code indicates a past or alternative mode of operation that was highly insecure. This is a latent risk if the build configuration were ever compromised or misunderstood.