Care Membrane MCP Server

This MCP server provides AI safety evaluation tools with reasonable core functionality, but has significant security and architectural concerns. The server implements rate limiting and optional API key authentication, but contains problematic patterns including unsafe path manipulation (sys.path.insert), insecure environment variable handling, and external network dependencies for metering without proper fallback validation. The metering infrastructure references undefined variables and lacks error handling. Additionally, the code attempts to load optional compliance modules from an unusual shared path, creating supply chain risks. While the analysis tools themselves appear functional, these implementation flaws and the unvalidated external meter dependency create moderate security risks. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.