miaw-mcp-server

Salesforce credentials (SCRT URL, Org ID, ES Developer Name) are correctly handled as environment variables, not hardcoded. Access tokens from Salesforce are stored server-side in-memory only and explicitly not persisted to disk, significantly reducing data retention risks. The server prevents exposing JWTs to ChatGPT by managing authentication internally with session IDs. Cross-Origin Resource Sharing (CORS) is enabled broadly (`*`), which is common for public APIs but could be tightened if client origins are specific. Content Security Policy (CSP) is defined for the embedded widget. No 'eval' or other directly malicious patterns were found in the provided source.