Agent Data Residency MCP Server

The server implements GDPR/EU AI Act compliance checking with reasonable separation of concerns and authentication layering. However, several security concerns reduce confidence: (1) the authentication fallback logic allows unauthenticated 'free' access with weak rate-limiting that relies on in-memory state (lost on restart), (2) a network meter endpoint is called with user API keys in plaintext JSON over HTTPS, creating credential exposure risk, (3) the auth_middleware stores API keys in plaintext in user home directory, and (4) input validation is minimal despite handling regulatory/compliance data. Permissions are appropriate for the stated purpose (compliance queries), but the implementation has operational security gaps that should be addressed before production use. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.