A2a Governance Bridge MCP Server

This MCP server has critical security vulnerabilities that make it unsuitable for production use. The server imports from a hardcoded local path (~/clawd/meok-labs-engine/shared) that doesn't exist in the repository, creating a dependency on undisclosed external code. The authentication mechanism delegates to an opaque external module without validation, and the server lacks input validation, making it vulnerable to prompt injection and data manipulation attacks. While the code itself doesn't contain malicious patterns, the architectural dependencies and trust assumptions are fundamentally unsafe. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.