Gadgethumans MCP Server

This MCP server implements a payment-gating proxy to a commercial API (gadgethumans) and requires users to provide wallet private keys via environment variables to function. Critical security issues include unvalidated environment variable usage in request headers (enabling header injection), exposure of private keys in logging output, and a design pattern that centralizes credential handling and routes all tool execution through an external service. The server lacks input validation on tool names and parameters, increasing attack surface. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue (1 critical, 0 high severity).

3 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.