mcp-server

The server employs robust input validation and sanitization using Zod schemas and custom utilities, mitigating common injection risks. Authentication middleware for the REST API validates API keys against a KV store, and administrative endpoints enforce permission checks. While test API keys are present in the repository, the design expects production keys to be managed securely via environment variables and Cloudflare KV. Outbound network calls to external APIs (for recommendations) and a Redis instance (for session management) are inherent to the hybrid architecture, requiring secure configuration. The project has an explicit `SECURITY.md` and `CODE_OF_CONDUCT.md` outlining responsible disclosure and best practices. There is no usage of `eval` or obvious obfuscation.