Flashcard Ai MCP Server

This MCP server has critical security vulnerabilities that make it unsuitable for production use. The code imports an external authentication middleware from a hardcoded path (`~/clawd/meok-labs-engine/shared/auth_middleware.py`) that is not provided, making authentication unverifiable and potentially bypassable. Additionally, all tools accept an optional `api_key` parameter but the authentication mechanism is opaque and untested. In-memory data storage with no persistence means all flashcard data is lost on restart. The server also has a rate-limiting implementation with a hardcoded `FREE_DAILY_LIMIT` that can be trivially bypassed by using different client identifiers. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.