Webhook Ai MCP Server

The webhook-ai-mcp server implements authentication and rate limiting via auth_middleware.py, but contains several security concerns that warrant attention. The server lacks input validation on webhook payloads and signature data, stores sensitive operational data (event logs, endpoints, audit trails) in user home directories without encryption, and relies on a home-directory-based authentication system that is easily bypassable. While the authentication middleware provides a structure for tiered access, it is not enforced at the transport layer, allowing unauthenticated access to all tools if the API key parameter is omitted. Additionally, the code contains hardcoded monetization URLs and some practices that weaken the security posture. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.