Tax Calculator Ai MCP Server

This tax calculator MCP server implements basic authentication via API keys and rate limiting, but has several security and design concerns. The auth middleware lacks proper token validation, credentials are exposed via environment variables without encryption, and the server makes unauthenticated filesystem writes to track usage. File-based key storage and audit logs are world-readable by default, creating data exposure risks. The code quality is reasonable but error handling could be more robust. Permissions are appropriate for a developer tool (no shell execution or dangerous operations detected), but the authentication layer is weak relative to the access control it claims to enforce. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.