Unit Converter Ai MCP Server

This MCP server implements basic unit conversion functionality with a monetization layer, but contains several security and design concerns. The authentication middleware uses local file-based storage for API keys and rate limiting without encryption, sensitive data (API keys, usage patterns) is stored in plaintext in the user's home directory, and the rate-limiting implementation has logical flaws. Additionally, the server embeds aggressive monetization/upselling behavior directly into tool responses, which may violate user expectations. While the code is not malicious, these issues represent moderate security and privacy risks that users should be aware of. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.