Airspace Monitor MCP Server

This MCP server implements airspace monitoring with read-only, stateless tools that check drone flight restrictions. While authentication is properly handled through API keys with fail-open behavior, several security concerns emerge: the server makes unsolicited network calls to an external metering service (proofof.ai) for every tool invocation without explicit user consent, stores hardcoded sensitive URLs in source code, relies on environment variables for attestation keys, and contains monetization logic that could be perceived as hidden cost structures. The server's permissions are appropriate for its purpose (network_http for metering, read-only file operations, env_vars), but the lack of transparency around external data transmission and the aggressive metering infrastructure warrant a moderate risk rating. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.