mcp-server

The server uses Zod for input validation for its registered tools, which is a strong security practice. It requires the WEBFLOW_TOKEN to be provided via environment variable, preventing hardcoded secrets. The `designerAppBridge`'s Socket.IO server has CORS configured for `*` (any origin) for local development/bridge purposes, which is acceptable for this specific local-only context but would be a vulnerability if the server were publicly exposed. RPC calls to the Webflow Designer App pass arguments based on validated Zod schemas on the server side, shifting the direct execution risk to the client-side app, which should have its own robust validation. No direct `eval` or obfuscation was found in the provided source code.