Agent Delegation MCP Server

This MCP server has significant security concerns centered on authentication bypass, unauthenticated network calls, and misleading behavioral claims. While the code structure is reasonable and uses FastMCP properly, the authentication layer is fundamentally broken—all tools claim to be read-only and non-modifying but actually perform stateful operations on in-memory data structures. The server makes external HTTP calls to verify.meok.ai without proper error handling or timeout enforcement, and docstrings systematically misrepresent tool behavior. Authentication checks exist but contain logic flaws that allow unauthenticated access. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.