Voice Audio MCP Server

This MCP server implements voice/audio analysis tools with a rate-limiting and tiered access control system. While the authentication middleware shows reasonable design intent, there are significant vulnerabilities: (1) the `auth_middleware.py` path assumption (`~/clawd/meok-labs-engine/shared`) creates portability issues and potential privilege escalation risks, (2) sensitive rate-limit and API key data is stored in plaintext JSON files in the home directory with no encryption, (3) file operations in `transcribe_audio` and `analyze_audio` lack proper path traversal validation despite checking file existence, and (4) the rate-limiting logic uses time-based dictionary keys that can be spoofed via timezone manipulation. The monetization/upsell pattern is aggressive but not malicious. Permissions align with stated purpose (audio processing, file I/O, network calls to local Whisper service). Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.