Construction Iso 19650 MCP Server

This MCP server implements authentication and rate-limiting mechanisms with a fallback to a shared auth engine, but has several security and design concerns. The reliance on a local filesystem path for the auth engine (~/clawd/meok-labs-engine/shared) creates a supply chain risk, the API key is read from environment variables but validation is basic, and all tools are currently stubs that provide no actual functionality. The rate-limiting implementation uses in-memory storage that resets on server restart and doesn't properly key by authenticated user. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

3 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.