Agent Orchestrator MCP Server

This MCP server has critical security vulnerabilities stemming from an external authentication dependency with unknown provenance and a hardcoded filesystem path that could cause operational issues. The server imports `auth_middleware` from a non-standard location (`~/clawd/meok-labs-engine/shared`), which is neither packaged, version-controlled in the repository, nor documented. This creates a supply chain risk and makes the authentication mechanism unauditable. Additionally, the code exhibits weak input validation, overly broad exception handling, and potential privilege escalation concerns through trust-level manipulation. While the rate limiting and file locking mechanisms are well-intentioned, they do not mitigate the core authentication and dependency risks. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.