Agent Orchestrator MCP Server

This MCP server implements multi-agent task management with local persistence and basic rate limiting, but has several security concerns. The server makes unauthenticated external HTTP calls to a metering endpoint (proofof.ai/verify) that could expose API keys and user context, the auth_middleware file is truncated/incomplete raising integrity questions, and there are weak input validation patterns. While the core functionality is sandboxed to local file operations and doesn't exhibit malicious patterns, the external metering calls and incomplete code quality present moderate risks that users should be aware of. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

5 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.