security

From read-only to governed: auditing my own MCP server

mcp-zerodha gives an AI model a real brokerage account and was already read-only. Auditing it the way an enterprise reviewer would still found five gaps. Here is each one and its fix.