Centralized MCP Server

The AgentPay Gateway is a legitimate MCP proxy server with reasonable architecture, but has significant security concerns that users should be aware of. Critical issues include: (1) missing authentication/authorization validation on the HTTP endpoint itself — any client can call tools if they know an API key format, (2) hardcoded backend URLs and lack of TLS verification, (3) overly broad environment variable access and unvalidated Stripe configuration, (4) insufficient input validation on tool arguments before proxying, and (5) a fundamental architectural flaw where credit deduction happens before backend execution, creating a race condition. The code quality is reasonable but these authentication and validation gaps create real abuse vectors. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 3 high severity).

5 files analyzed · 21 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.