mcp-server-for-apache-ofbiz

The server dynamically loads tools from a configurable `toolsFolderPath` using `await import(toolPath)`, which poses a significant Remote Code Execution (RCE) risk if an attacker can write to this directory or if the folder is not strictly controlled. The default CORS origin in `config.json` is set to `*`, which should be restricted for production. Sensitive tokens and client secrets (`BACKEND_ACCESS_TOKEN`, `MCP_SERVER_CLIENT_ID`, `MCP_SERVER_CLIENT_SECRET`) are stored in `config.json` (as updated by `update_token.sh`), which is less secure than using environment variables or a dedicated secrets manager. Additionally, the `openid-client` library uses `allowInsecureRequests` for discovery, which could introduce a risk if the configured authorization server URL is not HTTPS.