mcp-it

The `bind_openapi` feature fetches and parses OpenAPI specifications from arbitrary URLs, introducing a potential risk if pointed to untrusted or malicious sources that could craft malformed schemas leading to parsing errors or resource exhaustion. The `_external_proxy_call` function forwards incoming MCP request headers to external APIs without explicit filtering beyond common hop-by-hop headers. This means sensitive headers (e.g., internal authentication tokens) could be inadvertently forwarded to untrusted external services if not carefully managed by the user configuring `mcp-it`.