bb-mcp-server

The `local-eval` and `nrepl` modules provide full server-side code execution capabilities with no sandbox restrictions. This is a powerful feature for development and dynamic loading but poses a significant security risk if the server is exposed to untrusted users or agents without robust authentication and authorization. While the `streamable-http` module offers optional middleware for CORS, rate limiting, and basic/API key authentication, these are not universally enforced by default across all transports or modules, and `sente-browser` explicitly notes no authentication for local development. Hardcoded secrets are discouraged, with recommendations for environment variables.