uisp-mcp-server

CRITICAL VULNERABILITY: The `api-client.ts` explicitly sets `rejectUnauthorized: false` for HTTPS requests. This disables SSL/TLS certificate validation, making the application vulnerable to Man-in-the-Middle (MITM) attacks. Any data exchanged with the UISP CRM and NMS servers (including sensitive customer data, device configurations, and API keys) could be intercepted, read, or modified by an attacker without detection. This is a severe security flaw for any system handling critical infrastructure or private customer information. While input validation using Zod is good, and API keys are loaded from environment variables (good practice), the complete bypass of TLS security makes the entire system highly insecure. In-memory storage for alerts in `NetworkAlertManagerTool` is a functional limitation, not a security one, but can lead to data loss.