armoriq-mcp-server

The server critically lacks any form of authentication and authorization, allowing any client to access and modify any account by knowing its ID. Input validation for `amount` in deposit/withdraw endpoints is insufficient, as it does not prevent negative values, which can lead to unintended balance manipulation (e.g., a negative deposit becomes a withdrawal). No bounds checking for transaction amounts is present. The use of a local SQLite database (bank.db) implies lack of encryption at rest and is not suitable for high-security or concurrent production environments.