trustify-mcp

The server securely handles sensitive information (API URLs, OpenID credentials) by requiring them to be provided via environment variables, preventing hardcoding. Authentication is robustly implemented using the `trustify-auth` library and OpenID Connect for token validation. A `AUTH_DISABLED=true` environment variable exists for development purposes; enabling this in a production environment would bypass critical authentication and pose a severe security risk. URL construction for interacting with the Trustify API directly utilizes user-provided strings for path components (e.g., SBOM URIs). While `reqwest` handles some aspects of URL safety, the server relies on the Trustify backend to fully validate these URIs against potential path traversal or injection, rather than performing its own explicit exhaustive sanitization on these segments.