sample-mcp-server

The server's HTTP mode defaults to permissive CORS (allow_origins=['*']), which should be restricted in production. While it supports external authentication (e.g., Salesforce Named Credentials, API Keys), the server itself does not enforce authentication by default for most of its REST API endpoints, relying on external gateways or explicit middleware setup. The `/askme` endpoint acts as a proxy, handling Mobius credentials via HTTP Basic Auth. While certificate handling is implemented for Mobius SSL, proxying sensitive data requires careful security considerations for both the proxy and the upstream service. Temporary file handling for SSL certificates is present, requiring explicit cleanup.