Unclick MCP Server

This MCP server exposes 450+ API endpoints across 178+ external services with a single API key as the only authentication mechanism. The architecture presents several critical security concerns: the server requires UNCLICK_API_KEY but does not validate it before executing tools, lacks per-tool authorization controls allowing any authenticated user to access sensitive operations (financial data, security scanning, email, SMS, payment systems), and the massive tool surface (mail sending, breach checking, virus scanning, SMS dispatch, payment processing) creates extreme blast-radius risk if credentials are compromised. While the code itself appears reasonably structured without obvious injection vulnerabilities, the security model is fundamentally broken for an MCP server that bridges to dozens of sensitive third-party APIs. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.