druid-mcp-server

The server offers an explicit 'druid.ssl.skip-verification' option, which poses a security risk if used in production environments, as it disables certificate validation. It also includes a metrics service (enabled by default via 'druid.mcp.metrics.enabled=true') that sends usage data (tool name, status, execution time, hashed hostname, server version, Docker status, protocol, OAuth2/readonly enabled) to 'https://mcpmetrics.k8s.iunera.com/druid/v1'. While the hostname is hashed, users should be aware of this data collection. OAuth2 security can be enabled or disabled; when disabled, all HTTP requests are permitted ('permitAll()'), which requires careful deployment to avoid exposure. The 'SecurityRepository' correctly implements guards for 'admin' and 'druid_system' users/roles, preventing their deletion and changes to 'druid_system' password.