search-mcp

The server demonstrates a strong focus on security, particularly for authentication and token management. OAuth 2.1 with PKCE is implemented for intranet access, supporting both HTTP and Device Authorization Grant flows. Tokens are encrypted at rest using AES-256-GCM with a machine-derived key and stored with restrictive 0600 file permissions. All OAuth communication uses HTTPS, and tokens are explicitly prevented from being logged. Critical domain replacement for intranet requests is implemented to align with JWT authentication. No `eval` or dynamic code execution patterns were found. A minor potential friction point is the background HTTP server for device flow, which defaults to port 8080 in stdio mode, potentially leading to port conflicts.