moodle-webservice_mcp

The server defaults to `Access-Control-Allow-Origin: *`, which allows cross-origin requests from any domain. This is a significant security risk for production environments and should be explicitly configured to restrict origins. Token authentication via URL query parameters (`wstoken`) is supported as a fallback, which can lead to tokens being exposed in server logs or browser history, though it prioritizes the more secure `Authorization: Bearer` header. The plugin leverages Moodle's robust web service authentication and authorization system, and employs structured input/output validation, which are strong security practices.