xiaohongshu-mcp

The HTTP API uses '*' for CORS, which allows requests from any origin, potentially broadening the attack surface if the API is exposed to untrusted networks without additional authentication. The image/video downloader function, while validating `http/https` schemes, does not prevent Server-Side Request Forgery (SSRF) to internal network IPs, though a 30-second timeout helps mitigate resource exhaustion attacks. Cookie handling is local with `0644` file permissions, but account security relies heavily on the server's deployment environment and user practices. No explicit API key or token-based authentication beyond session cookies is observed for the HTTP API endpoints.