Csoai Governance Crosswalk MCP Server

This MCP server contains severe security vulnerabilities and critical malicious patterns. The code attempts to import from non-existent modules with hardcoded paths, includes unauthenticated API access without proper validation, stores API keys insecurely via environment variables without encryption, and exhibits path traversal risks through sys.path manipulation. Most critically, the server loads undeclared external dependencies (auth_middleware, ComplianceNeuralNet) from a hardcoded user home directory path, creating arbitrary code execution vulnerabilities. The authentication mechanism is fundamentally broken—it checks against a plaintext environment variable and provides fallback unauthenticated operation in 'dev mode'. This is extremely dangerous for a governance/compliance tool. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.