Quran On Web MCP Server

This is a read-only, unauthenticated Quran data MCP server with per-IP rate limiting, a body size cap, and static file data access, and its permissions match its purpose. The main concerns are minor: the stateless design keeps the rate limiter trusting an x-real-ip header that a direct client could spoof, the admin basic-auth comparison is non-constant-time and only active in dev, and the feedback service and sqlite handling were truncated and could not be fully reviewed. No malicious patterns, data exfiltration, shell execution, or hardcoded secrets were found in the analyzed MCP code. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity).

13 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.