Rag Knowledge Graph MCP Server

This RAG Knowledge Graph MCP server has a critical architectural flaw: it imports from a hardcoded shared path (`~/clawd/meok-labs-engine/shared/auth_middleware.py`) that does not exist in the repository and is not declared as a dependency. This breaks the server entirely and prevents proper authentication. Additionally, the server's docstrings falsely claim operations are read-only when `index_document`, `add_graph_edge`, and database operations actually modify persistent state. The authentication mechanism relies on local file-based API key storage without secure key rotation or validation, and rate limiting is trivial (15 calls/day can be bypassed by changing the user ID). While the code lacks obvious malicious patterns, these design issues create significant reliability and security concerns. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.