Hr Management Ai MCP Server

This HR management MCP server contains a critical security vulnerability: it imports and calls an external authentication middleware (`auth_middleware.check_access`) from a hardcoded path on the filesystem (`~/clawd/meok-labs-engine/shared`), which is not provided and cannot be audited. This represents a supply chain risk and potential code injection vector. Additionally, the server implements client-side rate limiting that can be trivially bypassed, and all five tools accept an `api_key` parameter that is passed to the unauditable auth middleware. The rate limiting and auth mechanisms provide a false sense of security while the core logic is sound. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.