Threats affecting pkg:github/presenton

Presenton versions before 0.8.8-beta include a bundled MCP server that is accessible without authentication on the /mcp path when deployed with session authentication via nginx. This occurs because the nginx front-end does not enforce the auth_request gate on /mcp, allowing remote unauthenticated attackers to invoke MCP tools and perform actions such as generating presentations and consuming configured LLM API keys. The Electron desktop build is not affected as MCP is disabled there. A fix is available in version 0.8.8-beta.