Stock Analyzer Ai MCP Server

The stock analyzer MCP server implements authentication and rate-limiting via a custom middleware, which is positive. However, there are several moderate security concerns: the auth middleware stores API keys and usage data in plaintext JSON files in the user's home directory without encryption, authentication can be bypassed by passing an empty api_key parameter, the rate-limiting implementation uses client-supplied data (the api_key string itself) as part of the hash without server-side validation, and path traversal patterns in the shared middleware directory path manipulation create potential vulnerabilities. The server itself does not make external API calls despite being a stock analyzer, which limits data exfiltration risk but raises questions about data accuracy. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.