litium-admin-mcp-server

The server relies on client-supplied HTTP headers (X-Litium-Client-Id, X-Litium-Client-Secret) for OAuth2 authentication with the Litium Admin API. While these credentials are not hardcoded, passing sensitive secrets in headers for a publicly deployed server (e.g., on Vercel) carries inherent risks if the communication channel is not secure (e.g., not HTTPS) or if the client itself is compromised. The `Access-Control-Allow-Origin: *` header is broadly permissive. The file upload functionality (`manage_media` tool) is designed to read local file paths on the server, which could pose a security risk in certain deployment scenarios (e.g., if arbitrary file paths could be specified by an attacker, or if deployed in a serverless environment where local filesystem access is not intended for user-uploaded content).