WeDaka-MCP

CRITICAL RISK: The `WedakaApiClient` explicitly disables SSL certificate validation (`rejectUnauthorized: false`) when making HTTPS requests. This makes all communications with the `WEDAKA_API_URL` vulnerable to Man-in-the-Middle (MITM) attacks, allowing attackers to intercept, read, or alter sensitive employee data. While noted 'as per API spec', this is a severe security flaw in either the API design or its integration. The server relies heavily on environment variables for authentication (`WEDAKA_USERNAME`, `WEDAKA_DEVICE_ID`, `WEDAKA_EMP_NO`), which is a standard practice but requires secure handling of these variables in the deployment environment. The `DEBUG_API` flag can expose raw API responses if enabled in production, which is a minor concern.