Sbom Cyclonedx MCP Server

This MCP server is a scaffold implementation with functional authentication and rate-limiting, but contains several security and design concerns that require attention. Key issues include unauthenticated access to all tools (free tier works with no API key), a hardcoded API key in environment variable without proper masking, rate-limiting that can be trivially bypassed by using different identifiers, and an unsafe fallback auth mechanism that accepts any request when the shared auth engine is unavailable. While the code lacks malicious patterns and implements reasonable auth scope, these authentication weaknesses combined with unclear data handling for future regulation mapping features create moderate risk. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

3 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.