facebook-ads-mcp

The server implements robust security practices: OAuth 2.1 with PKCE using WorkOS for user authentication, API key authentication with SHA-256 hashing and user-level validity checks against a D1 database, and explicit PII redaction and output sanitization via `pilpat-mcp-security` (v1.1.0+) in all tool outputs (Step 4.5). Secrets are managed through `.dev.vars` locally and `wrangler secrets` in production, not hardcoded. Concurrency is controlled via a Durable Object semaphore to prevent resource exhaustion. URL validation is present before external API calls. No `eval` or suspicious dynamic code execution is observed. The choice to disable email/phone PII redaction for ad content is a documented, deliberate business decision for publicly available marketing data.