Calendar Ai MCP Server

This MCP server implements calendar utilities with authentication and rate-limiting via a shared auth middleware. However, multiple security concerns reduce confidence: (1) the auth middleware stores API keys and usage data in plaintext JSON files in ~/.meok with weak hashing (SHA256 of predictable strings), (2) the server accepts api_key as a parameter rather than env vars, increasing exposure risk, (3) the _rl() rate-limit function uses insufficient tracking that could be bypassed, and (4) path traversal via sys.path.insert with user-expandable paths creates potential for module injection. The tools themselves are read-only and stateless, but the authentication layer is fundamentally flawed. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.