Agent Policy Enforcement MCP Server

This MCP server has moderate security concerns centered around unauthenticated access to core policy enforcement tools and reliance on an external metering system with fail-open behavior. While the server properly uses environment variables for API keys and includes HMAC attestation signing, the default allow behavior when authentication checks fail, combined with the lack of built-in rate limiting on unsigned requests, creates a gap between the stated security purpose (policy enforcement for EU AI Act compliance) and the actual enforcement. The code quality is reasonable, but the authentication model does not match the high-security use case. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.