Please report security vulnerabilities privately:

• Email: allmonday@126.com
• Subject prefix: [security] fastapi-gql-mcp

Do not open a public GitHub issue for security matters.

You will receive an acknowledgment within 48 hours. We aim to release a fix within 7 days for confirmed vulnerabilities affecting the default configuration.

• The fastapi_gql_mcp Python package published on PyPI
• The MCP server it exposes (transport, auth proxy, credential forwarding)
• Out of scope: vulnerabilities in your own FastAPI app's routes — the bridge executes them in-process with the caller's credentials and does not add its own authentication decisions