Invoice Generator Ai MCP Server

This MCP server has multiple critical security issues that make it unsuitable for production use. The most severe is an external dependency on a shared authentication module at a hardcoded path (`~/clawd/meok-labs-engine/shared/auth_middleware`) that is not included in the codebase, creating an opaque authentication mechanism that cannot be audited. Additionally, the server contains a rate-limiting system that is trivially bypassable via the `api_key` parameter (which has a default empty string), lacks input validation on critical fields like client names and item descriptions, stores invoices in-memory without persistence, and has broad network permissions. The authentication model appears to assume API keys but then silently allows empty keys, undermining security intent. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.