Ascii Art Ai MCP Server

This MCP server has critical security vulnerabilities that prevent it from being safely deployed. The most severe issue is a hardcoded, non-optional path injection (`sys.path.insert(0, os.path.expanduser('~/clawd/meok-labs-engine/shared'))`) that attempts to load an external authentication module from a user's home directory. This external dependency is not declared in package metadata, cannot be audited, and creates a supply chain attack vector. Additionally, all tools require an undocumented `api_key` parameter that is validated against an opaque external `auth_middleware` module, making it impossible to verify the security properties of the authentication system. The server also exposes an overly permissive health/discovery endpoint with CORS wildcard headers. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.