Agent Distribution Gateway MCP Server

This x402-paid Apollo.io person-enrichment MCP server is architecturally coherent, with payment verification, replay protection, and on-chain checks, but has findings that matter: a hardcoded dev bypass token that is active in non-production environments, an audit log written to disk without access control, and a hardcoded default payout wallet. The code was truncated before the facilitator settlement path, so that portion could not be verified. Permissions largely match the purpose of a paid enrichment gateway, but the score is reduced by the auth-bypass and payment-integrity concerns. Supply chain analysis found 5 known vulnerabilities in dependencies (2 critical, 1 high severity).

5 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.