mcp-server-orchestrator

The MCP Server (`services/mcp-server`) has `cors({ origin: '*' })` enabled by default, which is an overly permissive configuration and a significant security risk for production environments, as it allows any domain to make requests. The Orchestrator uses `JSON.parse(toolCall.arguments)` on LLM-generated strings; while `JSON.parse` itself is generally safe, robust schema validation (using Zod) within each custom tool is critical to prevent malformed inputs from causing unexpected application behavior or errors. Authentication to the Orchestrator is enforced via a `KAA` header, relying on a shared secret from environment variables, which is a good practice. Sensitive API keys and database credentials are correctly sourced from environment variables. The system's prompt for the LLM is verbose, but prompt injection remains an inherent risk in LLM-based systems.