Agent Commerce Payments MCP Server

This MCP server implements agent commerce and payment functionality with reasonable safety features, but has several concerning issues that lower its security posture. The server makes unauthenticated network calls to an external verification endpoint without proper error handling, contains vague and potentially misleading documentation about side effects, stores transaction state in-memory without persistence, and has a confusing dual-authentication system that may create unexpected access patterns. The code quality is fair with appropriate input validation, but the architecture and claims about immutability contradict the actual behavior. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

8 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.