cfbd-mcp-server

The server correctly uses environment variables for `CFBD_API_KEY` and `MCP_API_KEY`, preventing hardcoded secrets. It implements optional bearer token authentication for the `/mcp` endpoint. Input validation is minimal for `team` and `year` parameters, relying on CFBD API for handling, which is generally acceptable for public APIs. Extensive logging in some variants could expose request details, but it's not a critical vulnerability. CORS is implicitly open for all origins as `cors()` is used without specific origin restrictions in some included files, which is common for tool servers but could be tightened if needed. The primary server.js does not explicitly configure cors, but express does not restrict it by default. The server does not use `eval` or other highly dangerous patterns.