Text Stats Ai MCP Server

This MCP server implements a rate-limiting and tiered authentication system with legitimate use cases, but contains several security concerns that warrant user attention. The primary issues are: (1) unauthenticated free-tier access with weak rate limiting (15 calls/day globally across all users), (2) direct file system writes to user home directory (~/.meok/) without permission validation, (3) hardcoded Stripe URLs used for monetization/upselling embedded throughout tool responses, and (4) reliance on a shared authentication middleware file that is expected to be deployed to a local path but is imported dynamically with minimal validation. The code lacks input validation on several parameters (wpm, top_n, min_length), and audit logging is incomplete for free-tier users. While the tools themselves (word_count, reading_time, keyword_density, sentiment_score) perform legitimate text analysis, the authentication and monetization layer introduces trust and permission concerns inappropriate for the category. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.