Legal Document Ai MCP Server

This MCP server implements legal document analysis tools with reasonable core functionality, but has several security and architectural concerns that limit confidence. The server imports an external auth_middleware module from a non-standard path that is not packaged with the server, relies on filesystem-based API key storage with weak isolation, and includes a path traversal pattern in the import mechanism. While the tools themselves are read-only and stateless, the authentication system lacks proper validation and token rotation mechanisms. The rate-limiting implementation is in-memory and not persistent across restarts. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.