Vector Knowledge Graph MCP Server

This MCP server implements a vector knowledge graph with authentication and rate-limiting via a custom auth middleware. However, several security and code quality issues reduce confidence: (1) the auth system relies on local file-based storage without encryption, making API keys and usage data vulnerable; (2) in-memory graph data (_NODES, _EDGES) is not persisted and lost on restart, undermining compliance use cases; (3) embeddings are generated via MD5 hashing rather than real semantic vectors, limiting utility; (4) the server exposes monetization endpoints and upsell logic that may not align with MCP design patterns; (5) the auth middleware is imported from a hardcoded shared path that may not exist in all deployments. While the server does not exhibit malicious patterns or dangerous code, these architectural weaknesses and lack of persistent storage warrant caution for production use, especially given the stated EU AI Act compliance focus. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.