Avenity Agentic Audit MCP Server

This MCP server implements an AI-visibility audit service with payment integration via x402. The code is well-structured and properly avoids hardcoding secrets, using environment variables for sensitive configuration. However, there are several moderate-risk concerns: the `run_visibility_scan()` function is a non-functional placeholder that always returns unverified data, potentially misleading agents; payment proof validation is completely absent, creating a critical gap in the x402 settlement flow; and file-based order storage lacks access controls and could be exposed if the file path is writable by unauthorized processes. These issues are mitigated by the fact that payment processing delegates to an external x402 facilitator, but the lack of validation before recording orders is a real vulnerability. Supply chain analysis found 5 known vulnerabilities in dependencies (1 critical, 3 high severity).

2 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.