Accessibility Ai MCP Server

This MCP server has a critical dependency on an undisclosed, external authentication middleware (`auth_middleware` from `~/clawd/meok-labs-engine/shared`) that is not shipped with the package and cannot be audited. The server injects this path into sys.path and imports `check_access` without any fallback or validation, creating a supply chain vulnerability where authentication can be bypassed or manipulated by modifying a shared system path. Additionally, all tools accept an `api_key` parameter that is passed to this opaque middleware, but there is no validation of the parameter itself before use. The rate limiting implementation is in-memory and easily bypassed. While the core accessibility checking logic is sound, the authentication architecture is fundamentally broken. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.