Security Fixes
-
OAuth server localhost binding — The OAuth callback server now binds to
127.0.0.1instead of all network interfaces, preventing the callback endpoint from being reachable over the network on multi-homed systems. -
Input validation for tool arguments — Added runtime validation across all tool handlers:
- Required string fields (profileId, campaignId, etc.) are checked to be non-empty strings
- Date fields (startDate, endDate) are validated to match
YYYY-MM-DDformat - Numeric fields (bid, dailyBudget) are validated to be positive finite numbers