REMOTE_MCP_SERVERS_JACK

The `scripts/get_spotify_token.py` utility contains hardcoded `CLIENT_ID` and `CLIENT_SECRET` values. While the primary server implementation correctly uses environment variables and Google Secret Manager for credentials, this script's hardcoded values could be a source of confusion or a potential security oversight if not replaced with user-specific credentials during the OAuth flow. The server itself manages refresh tokens and retrieves client credentials from secure environment variables. A `TODO` exists to persist new refresh tokens to a database/Secret Manager, which is a future enhancement but not a current security vulnerability.