zeromcp

The server uses Python's built-in `http.server` modules, which are generally safe for controlled environments but may lack advanced production-grade security features. It correctly implements CORS with a sensible default of allowing localhost origins, and configurable options for more restrictive or permissive policies. A `post_body_limit` is in place to prevent overly large payloads. The core logic for dispatching calls to registered functions is safe as it relies on explicit function registration by the developer, not arbitrary code execution. By default, exceptions expose full tracebacks, which is useful for development but should be redacted in production (configurable via `registry.redact_exceptions = True`) to prevent information leakage.