OpenCodeMCP

CRITICAL: The `src/auth.ts` file explicitly disables authentication by always returning `true` in `validateAuth`, despite requiring `MCP_API_KEY` in environment variables. This means any client can interact with the server and subsequently control the OpenCode agent to read, modify, or execute code on the connected codebase without any authentication. This is a severe vulnerability. Additionally, direct path usage in tools like `list_files`, `read_file`, `find_text`, `find_files`, and `add_alias` (via `sessionManager.resolveProjectPath`) could expose the system to directory traversal or other file system manipulation if not rigorously sanitized by the underlying OpenCode SDK, especially given the lack of authentication. While the `opencode-ai/sdk` might handle some sanitization, the server's own authentication being disabled is a paramount risk.