Logistics Ai MCP Server

This MCP server has critical security vulnerabilities centered on unsafe path manipulation and unauthenticated remote file access. The server imports from a hardcoded local path (`~/clawd/meok-labs-engine/shared`) that does not exist in the repository, creating a dependency injection risk. The auth_middleware module itself is missing from the provided codebase but is loaded via sys.path manipulation, and there is no validation that it comes from a trusted source. Additionally, the API key system is bypassable (empty key defaults to free tier with 40 calls/day), and authentication is optional for all tools, making them publicly accessible. While the tools themselves perform only read-only computations without direct filesystem or network calls, the architectural patterns introduce significant risks for users who run this server. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.