mcp-server-planton

The server employs a 'passthrough' security model for HTTP transport: user API keys from the Authorization header are extracted and forwarded to Planton Cloud APIs for authentication and fine-grained authorization (FGA), rather than being validated locally. This offloads robust validation to the backend. The `PLANTON_API_KEY` is handled securely via environment variables or request headers and is not hardcoded. A global state workaround is used for API key context propagation in tool handlers due to `mcp-go` library limitations, which could introduce theoretical race conditions in high-concurrency (non-SSE typical) scenarios. The project has a defined security reporting process.