vonage-mcp-server

The HTTP wrapper (`src/http-server.ts`), designed for integration with external applications like Dify, uses `process.env.VONAGE_APPLICATION_ID` as the API key for authentication (`X-API-KEY` header). As the `VONAGE_APPLICATION_ID` is an identifier and not a secret, it can be easily discovered or exposed, leading to unauthorized access and control of Vonage services (SMS sending, voice calls) through the server's HTTP endpoints. While private keys are loaded from files and other secrets via environment variables, this weak authentication for HTTP exposure is a critical vulnerability. No signs of 'eval', obfuscation, or other overt malicious patterns were found. For local usage via StdioServerTransport (e.g., with Claude Desktop), the immediate network exposure risk is significantly lower.