Care Home Cqc MCP Server

The MCP server implements basic rate-limiting and an API key authentication mechanism, but has several security concerns that warrant attention. The server reads environment variables for authentication and makes unauthenticated HTTP calls to an external verification endpoint without strict error handling. Input validation is minimal, and the monetization/upsell layer introduces unnecessary complexity. While the server's stated purpose (CQC compliance checking) aligns with its permissions, the authentication implementation allows unauthenticated access to all tools via a permissive default fallback, and the external verification endpoint creates a dependency that could be exploited. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

5 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.