lc-mcp-server

The project demonstrates a strong focus on security, especially for multi-tenant environments. Key strengths include mandatory AES-256-GCM encryption for OAuth tokens (REDIS_ENCRYPTION_KEY), extensive testing for credential isolation and concurrency safety (100% test coverage in internal/auth/), and UID validation. The `lc_call_tool` meta-tool allows dynamic invocation of other tools, but is protected by a meta-tool filter mechanism (allow/deny lists). Powerful operations like direct sensor command execution and payload upload/download are core to the security platform integration, and are inherently high-risk, though file path validation is implemented. A hardcoded Firebase API key is noted, but generally considered low risk for client-side Firebase interaction.