mcp-auth

Hardcoded default admin credentials ('admin'/'admin') are present in `docker-compose.yml` and `setup_keycloak.py` for initial Keycloak setup. Keycloak is configured with `KC_HOSTNAME_STRICT: "false"` and `KC_HTTP_ENABLED: "true"` in `docker-compose.yml`, relaxing hostname validation and enabling HTTP for development, which could pose risks if deployed directly to production. The setup instructions recommend disabling Keycloak's "Trusted Hosts" client registration policy, further relaxing security for dynamic client registration. A hardcoded client secret (`PLOs4j6ti521kb5ZVVVwi5GWi9eDYTwq`) is present in `keycloak-standalone/config.json` for the `echo-mcp-server` client. Test user credentials (`mcp-admin: admin123`, `mcp-user: user123`, `mcp-readonly: readonly123`) are hardcoded in `config.json`. Environment variables for OIDC configuration in `server.py` have hardcoded defaults, requiring explicit override for production.