springai-mcp-gateway

The project is explicitly labeled as a 'learning and integration reference' and 'not meant to be a production-grade gateway'. Security relaxations are made for simplicity, including disabled CSRF protection and broadly configured CORS (allowing all origins, methods, and headers with credentials). It uses a hardcoded in-memory user ('omar/secret') and a client ID ('springai-gateway-client') for the Authorization Server demo, with explicit warnings against using these in production. While transparent about these known issues, they represent significant vulnerabilities if deployed without modification. The use of Cloudflare Tunnel for exposure offers some network security benefits.