mcp-boilerplate-node

The boilerplate's `apiRouterFactory` directly exposes MCP tools as REST API endpoints without built-in authentication or authorization, which requires careful implementation by the user for sensitive operations. The 'Skills' feature allows loading content from configured GitHub repositories; this introduces a supply chain risk if untrusted or compromised repositories are used. While local file path traversal is mitigated by `normalizeSkillPath`, the inherent trust in external GitHub sources for skill content is a significant consideration. OpenTelemetry integration, while beneficial for observability, could inadvertently expose sensitive data if not configured properly by the implementer.