remote-mcp-server-authless

The README title "Without Auth" is misleading; the server *does* implement token-based authentication by expecting a Bearer token in the `Authorization` header for `/sse` and `/mcp` endpoints. This token is then stored in Durable Object storage per session for tool access. Tools like `edit_image_with_lora` and `edit_image_text` default `disable_safety_checker` to `true`, which could allow the generation of inappropriate or unsafe content if not properly filtered by the upstream LLM/agent. Console logs indicate whether a bearer token is present, which is a minor information disclosure risk in some logging configurations.