mcp-server

The server lacks built-in authentication, authorization, rate limiting, and audit logging. The source code and README explicitly state this endpoint should NOT be exposed directly and mandates routing all requests through an external proxy layer (e.g., ArmorIQ) for security. Data is stored in-memory, meaning all booking and session data is lost upon server restart, which is a significant operational limitation. Basic input validation is present for some tool arguments (e.g., email format, date format, positive integers), but overall security relies heavily on external infrastructure.