pipedrive-api-token

CRITICAL: The server's default configuration for API key validation (used for '/mcp/tools/call') accepts *any* non-empty API key if 'VALID_API_KEYS' environment variable is not explicitly set. This makes the tool execution endpoint vulnerable to unauthorized access in its default state, even with warnings in the code. Furthermore, '/mcp/initialize' and '/mcp/tools/public' endpoints are *unauthenticated* in the provided source code (main.py), directly contradicting the README's claim that all MCP endpoints require JWT. The default 'JWT_SECRET_KEY' is also a fallback 'dev-fallback-key-change-in-production', which is highly insecure for production. Permissive CORS ('*') is also configured by default. These issues combine to create a very low security posture out-of-the-box.