experience-layer

The server's HTTP, WebSocket, and UDP interfaces lack explicit authentication and authorization. The HTTP API exposes internal tool handlers via an endpoint (`/api/tools/:toolName`) that directly executes tool functions with unvalidated user input (`req.body`) against the defined JSON schemas. This design, coupled with permissive CORS (`Access-Control-Allow-Origin: *`), makes the server vulnerable to unauthenticated access, arbitrary tool execution, and potential data manipulation or denial-of-service if exposed to untrusted networks or compromised peers. The UDP InterLock mesh also operates without authentication, relying solely on a basic signal whitelist (tumbler).