Ai Gateway MCP Server

This MCP server contains multiple critical security vulnerabilities including unsafe path insertion from untrusted environment variables, unauthenticated network calls to external metering services, and a problematic dependency on shared auth code via hardcoded paths. The server performs server-side verification calls to an external metering endpoint with user-supplied API keys, creating data leakage risks. Additionally, the authentication model is poorly designed with fail-open behavior that defeats security controls. Code quality issues and overly permissive imports further compound these concerns. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.