Inventory Management Ai MCP Server

This MCP server has critical security vulnerabilities that prevent safe deployment. The code contains an external path injection attack via `sys.path.insert(0, os.path.expanduser('~/clawd/meok-labs-engine/shared'))`, which loads untrusted authentication middleware from an external directory not included in the repository. This creates a severe supply chain and execution risk. Additionally, the authentication system is not properly implemented—all tools accept an optional `api_key` parameter but don't meaningfully validate it, and the rate limiting is trivially bypassable. The server also lacks input validation on several dangerous operations, and imports from an undeclared external dependency. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.