kernel-mcp-server

The server employs OAuth 2.0 with Clerk for authentication and stores sensitive tokens (JWTs, refresh tokens) securely hashed in Redis using HMAC-SHA256 with `CLERK_SECRET_KEY`. It explicitly checks for and requires critical environment variables for sensitive IDs and keys. CORS is set to `Access-Control-Allow-Origin: *` for public API endpoints, which is acceptable given the authentication mechanisms. The `/mcp` endpoint supports both JWT-based (Clerk) and non-JWT (API key) authentication paths; the security of the API key path relies heavily on the `Kernel` SDK's backend validation. User-provided Playwright code is executed via the `Kernel` platform API, implying execution in a sandboxed, managed environment rather than directly on this server.