Quantrisk MCP Server

QuantRisk MCP server has reasonable authentication via API keys and appropriate permissions for its purpose (financial data APIs, network access). However, several code quality and security concerns reduce confidence: missing input validation on user-supplied portfolio data, overly broad error handling that may log sensitive information, the Stripe webhook handler lacks robust signature verification with inadequate error differentiation, and the API key generation uses UUID truncation which is acceptable but could be more explicit. No evidence of data exfiltration or malicious patterns, but the codebase needs hardening around credential handling and input validation for production use. Supply chain analysis found 6 known vulnerabilities in dependencies (1 critical, 5 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.