Commit Message Ai MCP Server

This MCP server has critical security vulnerabilities stemming from external authentication dependency and unsafe sys.path manipulation. The server relies on an external shared auth_middleware module that is not included or version-locked, creating a supply chain risk. Additionally, the code inserts expandable home directory paths directly into sys.path, which could allow local privilege escalation or code injection. Rate limiting is client-side and bypassable. While the core commit message logic is sound, these infrastructure issues make the server unsafe to deploy without significant remediation. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.