mcpflare

Implements multi-layered security including V8 isolate sandboxing (Cloudflare Workers), network isolation (default zero outbound access, configurable allowlist), and pre-execution code validation to block dangerous patterns like `eval()`, `require()`, `process`, `__dirname`, `__filename`, `global.`, and external `import` statements. All MCP tool calls are routed through this secure isolation layer. Sensitive information like API tokens in HTTP headers are masked in logs. Authentication (e.g., OAuth) for URL-based MCPs is handled through the proxy, but MCPflare itself does not implement OAuth flows for third-party MCPs, requiring pre-configured authorization headers for those.