yuque-mcp-server

The `docker-compose.yml` includes a hardcoded example `YUQUE_TOKEN` value as a default, which is a security anti-pattern. While intended for local testing or as a fallback, it's preferable to avoid any hardcoded secrets. The `install_service.sh` script modifies the `com.yuque.mcp.plist` file directly within the project's cloned directory during installation, which can lead to unexpected behavior or issues with version control. The server's CORS policy is set to allow all origins (`*`), which is acceptable for a locally-run proxy but broader than strictly necessary. Authentication token handling is well-documented with priority given to HTTP headers, environment variables, and config files, which is good practice.