Fishkeeper Ai MCP Server

This MCP server contains a critical authentication bypass vulnerability and unsafe path manipulation that expose it to unauthorized access and potential code execution. The sys.path.insert(0) pattern to load external authentication middleware from a user-controlled home directory is extremely dangerous and allows privilege escalation. Additionally, the hardcoded reference to an external auth system without verification, combined with unauthenticated tool access in certain failure paths, creates multiple security holes that must be addressed before deployment. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.