Unclick MCP Server

This MCP server exposes 450+ API integrations across diverse services with significant security concerns. Critical findings include: (1) API keys passed via tool parameters instead of secure env var handling, creating credential exfiltration risk; (2) overly broad permissions with no scope limiting per-user/per-tool; (3) unauthenticated tools accessible without API key validation; (4) sensitive operations (email, payments, infrastructure) exposed without additional authorization checks. While the server's purpose justifies broad network access, the credential handling patterns and lack of per-operation auth controls create substantial risk for credential compromise and unauthorized API calls. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.