Tone Rewriter Ai MCP Server

This MCP server implements text tone analysis with an authentication and rate-limiting system. While the core tone analysis logic is safe, the server has several security and design concerns: (1) authentication is weak—empty API keys default to free tier with no validation, allowing unlimited free-tier access without credentials; (2) local filesystem-based credential and usage tracking in ~/.meok/ is vulnerable to privilege escalation and tampering; (3) hardcoded Stripe URLs and monetization logic embedded in tool responses creates a poor separation of concerns; (4) the auth_middleware imports expect a specific shared directory structure that may not exist, introducing fragility; (5) rate limiting relies on local state that can be manipulated. The server does not exfiltrate data or contain malicious code, but the authentication model is fundamentally flawed for production use. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.