Commerce Validators MCP Server

This ecommerce validators MCP server is well-intentioned and implements reasonable security controls (Pro key gating, input validation, no hardcoded secrets), but has several moderate concerns: the `.keys.json` file is stored in the repository directory with inadequate access controls, the Pro key validation uses simple HMAC comparison without rate limiting or rotation mechanisms, environment variable-based key exposure through context vars could leak in error logs, and network calls lack comprehensive error handling for security-relevant failures. The codebase is clean and permissions appropriately match purpose (network_http for live lookups, env_vars for config), but the authentication layer needs hardening before production use. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity).

3 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.