Agent Distribution Gateway MCP Server

The server is an x402 paid Apollo.io person-enrichment broker that advertises 'zero signup or API key required' and includes a hardcoded dev bypass token (dev_test_payment_proof_2026) that is active in any non-production environment and also baked into the public frontend, letting callers obtain paid enrichment for free. A hardcoded fallback payment recipient wallet and a dev-only fake transaction path further weaken payment enforcement, and the submitted code is truncated so the Apollo connector and remaining test harness could not be reviewed. The key issues driving the low score are the payment bypass and unauthenticated access to a data-enrichment service that returns personal contact data. Supply chain analysis found 5 known vulnerabilities in dependencies (2 critical, 1 high severity).

8 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.