uipath-mcp-server

CRITICAL VULNERABILITIES: 1. SSL Verification Disabled: The system defaults to `verify=False` for HTTPX requests when connecting to non-UiPath Cloud URLs, which is a critical vulnerability for Man-in-the-Middle (MITM) attacks. While this might be a workaround for self-signed certificates in on-premise environments, it should be configurable and ideally use a trusted certificate store. 2. Weak Default Secrets: A hardcoded default `SECRET_KEY` is used for JWT token signing if not overridden by an environment variable, making JWT tokens easily forgeable. Similarly, a default `admin`/`admin` user is created on first startup, exposing the system to immediate compromise if left unchanged. Other concerns include: non-expiring API tokens and support for passing tokens in URL query parameters, which is less secure.