cloudflare-mcp-server

The code is primarily an auth-protecting MCP server with standard request routing and token validation. However, it contains a significant security anti-pattern: the echo_auth tool intentionally reflects authentication material back to callers, including a partial bearer token prefix and the userId. Additionally, token validation transmits the raw bearer token to an externally configured validation API without hostname allowlisting or safeguards in this module. While there are no strong indicators of malware, the module presents a medium-to-high security risk due to authentication data disclosure and potential token exfiltration via misconfiguration.