1. MCP-Hub Endpoint Exposed Without Auth or Rate Limiting, Relies on Network Isolation
A critical security oversight has been identified in the MCP-Hub server, where its primary JSON-RPC endpoint is exposed without standard authentication or rate-limiting controls. The hub's `POST /` endpoint, which handles sensitive operations like `execute_code`, is bound to `0.0.0.0` and accepts requests from any proc...