Agent Negotiation MCP Server

This MCP server has critical security issues that make it unsafe to deploy. The code imports an external authentication middleware from a user-controlled path (`~/clawd/meok-labs-engine/shared`) without verification, creating a supply chain attack vector. Additionally, the authentication check appears to be bypassable (accepting empty API keys as 'free tier'), and the server loads untrusted Python code at startup. While the negotiation logic itself is benign, these systemic security flaws present serious risks. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.