inboxfewer

The project demonstrates a strong security posture. It adheres to Kubernetes Pod Security Standards (Restricted), defaults to `runAsNonRoot`, drops all capabilities, and uses a read-only root filesystem. Secrets management emphasizes using Kubernetes Secrets or external managers, with explicit warnings against unsafe practices. The OAuth proxy architecture prevents AI assistants from directly handling sensitive tokens. Instrumentation features include security warnings for insecure OTLP endpoints. The `mcp-oauth` library implements robust OAuth 2.1 hardening (PKCE, refresh token rotation, authenticated client registration, rate limiting) with secure defaults and verbose logging for potential misconfigurations. Comprehensive security documentation is provided.