simple_mcp_server

The server implements its own OAuth 2.1 authorization server with PKCE, which is a good security practice. User authentication is delegated to Supabase, enhancing security. However, access tokens and authorization codes are stored in-memory, making them non-persistent across server restarts, which is a functional limitation (not a direct security vulnerability, but impacts session management). The CORS policy is highly permissive ('*'), which is common for AI integrations but broad. There are no obvious 'eval' or similar dangerous functions, nor hardcoded secrets beyond environment variable defaults.