mcphub

The system includes user authentication and role-based access control, with password hashing for user credentials. It leverages `@node-oauth/oauth2-server` for robust OAuth 2.0 implementation. Environment variables (like API keys) are typically loaded from `process.env` or `mcp_settings.json` and warned if not set in production. The `StdioClientTransport` allows administrators to configure and execute arbitrary commands, which is a core feature for managing external MCP servers; this capability is restricted to authenticated users with write permissions, implying trust in administrators not to inject malicious commands. No direct `eval` or blatant unauthenticated Remote Code Execution (RCE) vectors were identified. File uploads for DXT archives are handled with `AdmZip.extractAllTo` to a temporary, generated directory, reducing path traversal risks.