Implements a robust authentication system with clear priority hierarchy (CLI args > env vars > HTTP headers), proper validation (cabinet requires API key), and AsyncLocalStorage for context propagation in HTTP transport. Demonstrates non-obvious skill in handling multiple authentication sources with appropriate fallbacks and validation logic.

A comprehensive telemetry system with multiple opt-out layers (DO_NOT_TRACK, DGREP_TELEMETRY, config), fire-and-forget design that doesn't block operations, and clear separation of event definition, transport, and opt-out logic. Shows exceptional privacy-first design by collecting only metadata (command name, success/failure, latency) without any user data.

Maps HTTP status codes and error envelopes to specific TypeScript exception classes (AuthenticationError, InvalidRequestError, RateLimitError, APIError) while preserving request IDs from both response envelopes and headers. Demonstrates clean error design with proper inheritance and meaningful distinctions between error types.

Handles both stdio and HTTP transports for the MCP server with features like automatic port discovery (tries multiple ports if primary is busy), DNS rebinding protection, proper handling of webhook/OAuth discovery endpoints, and comprehensive CORS management. Exhibits strong engineering in building a robust, secure server implementation with proper error handling and resource cleanup.