faq-mcp-server

The 'docker-compose-admin.yml' file specifies a default 'ADMIN_PASSWORD=admin123', which is a critical security vulnerability if deployed without overriding. While the main 'docker-compose.yml' prompts for it as an environment variable, the presence of this insecure default in the codebase is concerning. Additionally, 'admin_server.py' contains commented-out functions ('last_n', 'download_data') that would write user data to a mounted volume. Although currently disabled, if reactivated or a similar vulnerability exists, it could lead to path traversal or arbitrary file write risks. Authentication for the 'add_faq' tool uses a robust method (secrets.compare_digest for password checking via headers) but relies on correct client-side configuration.