customercare-mcp-builder

This is a customer-care MCP reference implementation, not evidence of intentional malware; malware likelihood is low. Security risk is moderate because it includes plaintext demo PINs, logs complete request bodies, disables TLS verification for OpenSearch, and trusts metadata thread IDs for customer-specific access. The query is inserted into JSON without escaping, and the configurable OpenSearch destination is not restricted. These issues should be corrected before production use.