django-rest-framework-mcp

The MCP endpoint (`/mcp/`) uses `@csrf_exempt`, bypassing Django's CSRF protection; this is standard for API endpoints primarily consumed by non-browser clients, but should be noted. The overall security relies heavily on the underlying Django REST Framework's authentication, permission, and throttling configurations. The documentation explicitly warns that DRF's built-in throttling is not a robust security measure against sophisticated attacks like brute-forcing or Denial of Service (DoS). The demo `settings.py` includes a `SECRET_KEY` marked as 'insecure' by Django, which is acceptable for development/demo purposes but must be replaced in a production environment.