Compliance MCP Server

This MCP server implements a regulatory compliance intelligence service with several notable security gaps. The codebase lacks proper input validation on user-supplied filters (industry, agency, keyword) before passing them to database queries, creating injection risks. Authentication is implemented via optional Bearer tokens and x402 payment verification, but the auth model is permissive—unauthenticated access is allowed up to a daily free tier. Critical infrastructure secrets (Supabase service key, admin token) are accessed via environment variables but could be accidentally logged. The payment verification logic via Solana RPC is complex and relies on external state, introducing replay and timing vulnerabilities. Supply chain analysis found 5 known vulnerabilities in dependencies (1 critical, 3 high severity).

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.