Supply Chain MCP Server

This MCP server implements basic authentication and rate limiting, but has several notable security concerns. The authentication mechanism relies on a single environment variable without key validation, rate limiting is implemented in-memory and easily bypassed, and the server logs sensitive API keys. Additionally, the authentication middleware expects a non-standard shared path that may not exist. While the core supply chain functions appear legitimate, the weak auth enforcement and in-memory state management present moderate risk for unauthorized access and data tampering. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

5 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.