Secure-MCP-Gateway

The project emphasizes a 'security-first' design with comprehensive input validation (Zod), automatic PII/secret redaction in logs, policy-based access control, human-in-the-loop approvals, and structured audit logging. It utilizes security middleware like Helmet.js and `express-rate-limit`. Authentication with JWT and API keys is implemented, alongside OIDC integration. Key security considerations for deployment include an explicitly noted placeholder `JWT_SECRET` that *must* be changed in production, and a statement in `SECURITY_MODEL.md` that internal TLS/encryption is out of scope, relying on external transport (e.g., a reverse proxy). The provided Docker Compose setup for Redis lacks explicit authentication configuration, which can be a risk if not deployed in a trusted network or with additional Redis security measures.