crm_mcp_server

The server uses `helmet` and `express-rate-limit` for basic security. API key authentication for the REST API is optional, making it insecure by default if `REST_API_KEY` is not set. CORS is configured to `*`, which allows requests from any origin, posing a potential risk if not intended for public exposure. Sensitive credentials (Google service account key, Calendly API token, SendGrid API key) are loaded from environment variables and `credentials.json`, with clear instructions against committing them to version control, which is good practice. Input validation is present for critical parameters in tool calls, but extensive sanitization is not explicitly detailed. Direct calls to private methods via type assertion (`as any`) are used within the `MCPBridge`, which is a development pattern choice rather than a security flaw.