weather-mcp

The server uses environment variables for sensitive API keys (e.g., NOAA_CDO_TOKEN) and JWT secrets, which is good practice. Dynamic loading of tools, resources, and prompts is a core feature of the FastMCP framework; this is safe assuming the source code is trusted and not modifiable by untrusted users at runtime. JWT authentication is optional, and if not configured, the HTTP endpoint will be open. CORS configuration (MCP_HTTP_ALLOWED_ORIGINS) is mentioned in the architecture but not explicitly configured in the `mcp.run` call, which might require additional FastMCP or reverse proxy configuration for production. No direct `eval()` or `exec()` usage was found that would allow arbitrary code execution through user input.