nitro-mcp-server

CRITICAL: The server relies on local file system storage (fs driver) for `registrationStore` and `authCodeStore` to manage OAuth client registrations, authorization codes, and states. This is fundamentally insecure for production environments as it's vulnerable to local file system attacks and does not support distributed deployments or high availability. The 'Todo' section explicitly mentions a missing cleanup task for expired authorization codes, which is a significant vulnerability for resource exhaustion and potential misuse of stale codes. The `/auth/register` endpoint acts as a DCR proxy without inherent rate limiting, which is noted in the README as a point requiring external protection to prevent abuse.