Contract Review Ai MCP Server

This MCP server has several critical security issues that prevent approval. The most severe is an external code dependency (auth_middleware from ~/clawd/meok-labs-engine/shared) that is not version-controlled, auditable, or validated—this creates a supply chain vulnerability where arbitrary code could be injected. Additionally, the rate limiting implementation uses in-memory storage that persists across requests without proper cleanup, enabling authentication bypass through concurrent requests. The API key parameter is passed explicitly as a string argument rather than via secure environment variables, and authentication is applied inconsistently across tools with missing validation in some code paths. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.