Unclick MCP Server

This MCP server exposes a massive catalog of 450+ external API integrations with highly concerning patterns: credentials are passed as optional function parameters (api_key fields visible in schemas), authentication is inconsistently applied across tools, the server appears to accept and forward arbitrary API keys without validation, and there is no evidence of secure credential isolation. The codebase lacks input validation and error handling details. While the server itself may not be malicious, the authentication architecture creates severe risks for credential exposure, man-in-the-middle attacks, and unauthorized API access on behalf of users. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.