Workout Planner Ai MCP Server

The server implements a tiered authentication and rate-limiting system, which is good practice for a Developer Tools MCP. However, there are multiple security concerns: (1) the auth_middleware stores API keys and usage data in plaintext JSON files in ~/.meok without encryption, creating a credential exposure risk; (2) in-memory state (_progress, _usage) will be lost on restart and is not thread-safe; (3) the rate-limiting implementation uses hashed API keys inconsistently and can be bypassed via multiple anonymous requests; (4) environment variable handling for MEOK_PAYG_KEY lacks protection; and (5) user progress data is stored indefinitely with no access controls or data retention policies. While the server's tools themselves are functionally safe and permissions are appropriate for its purpose, the authentication and data handling architecture has weaknesses that expose both credentials and user data. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.