justcall-mcp-server

The server implements OAuth2 authentication with PKCE (Proof Key for Code Exchange) using S256, which is a strong security standard. All protected endpoints (`/mcp`, `/sse`, `/sse/message`) require Bearer token authentication, which is validated upon each request. API keys are expected to be provided via environment variables (`JUSTCALL_API_KEY`, `JUSTCALL_API_SECRET`) or as a bearer token in the `Authorization` header, preventing hardcoding. Input validation is performed using Zod schemas, mitigating common input-related vulnerabilities. No 'eval' or other directly dangerous functions are observed in the provided source, and network calls are restricted to the official JustCall API. The server is designed to run in environments like Cloudflare Workers, which can offer additional security benefits.