newline-mcp-server

The server uses JWT-based authentication with HMAC signing, relying on a secret key (`NEWLINE_HMAC_KEY`). While sensitive keys are loaded from environment variables as recommended, the `config.ts` provides default placeholder strings if these variables are not set. This would lead to authentication failures rather than a direct security compromise, but is a noteworthy configuration risk. The project explicitly states that external pull requests are not accepted due to operating within a regulated banking environment, and directs vulnerability reports to a HackerOne program, indicating a strong internal security focus. Proxy support is implemented via `https-proxy-agent`. Running via `npx git+...` involves executing remote code, which is a common practice but carries inherent supply chain risks.