Nohumansshop MCP Server

noHumansShop is an early-stage affiliate marketplace for AI agents with reasonable security foundations. Authentication via OAuth is properly implemented, and sensitive operations are gated behind bearer token verification. However, the codebase has notable gaps: a development-only tool (`simulate_acquisition`) that bypasses critical verification logic remains accessible in production if `NODE_ENV` check fails, input validation is present but could be more robust, and the lack of rate limiting on user-generated content (blogs, votes) creates potential abuse vectors. Permissions align with the platform's purpose (database, HTTP network for embeddings/affiliate links, environment variables for secrets). The code is well-structured with no evidence of malicious patterns, but the dev tool leakage and minimal input sanitization warrant attention before production release. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 1 high severity).

7 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.