Real Estate Listing MCP Server

This MCP server implements a real estate listing tool with built-in rate limiting and tiered authentication via a shared middleware. However, several security concerns undermine the implementation: (1) insecure path manipulation using sys.path.insert() to load shared auth_middleware from a user-controlled directory, creating a dependency on file system integrity; (2) rate limiting state stored in plaintext JSON files without atomicity guarantees; (3) API key storage in plaintext JSON accessible to all processes running under the user; (4) hardcoded path assumptions and directory creation with overly permissive defaults; (5) synthetic/mock data generation that could be confused with real market data if exposed; (6) lack of input validation on numeric parameters. While the tool logic itself is stateless and read-only, the authentication and access control implementation has material vulnerabilities. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.