OECD-MCP-server

The server demonstrates strong security practices including explicit input validation (Zod schemas), comprehensive filter sanitization (to prevent SSRF, command injection, XSS), internal rate limiting for external API calls, and request timeouts. Error messages are sanitized to prevent information leakage (e.g., file paths, internal IPs, stack traces). Kubernetes and Docker Compose configurations include robust security measures like running as non-root, read-only filesystems, and dropping capabilities. The main area for potential enhancement is the CORS configuration, which is currently set to allow all origins (`app.use(cors())`). In a production environment handling sensitive data, this should typically be restricted to specific, known client origins.