registry / @frihet/mcp-server / 1.16.3

@frihet/mcp-server@1.16.3

AI-native MCP server for Frihet ERP — 157 tools: invoicing, expenses, CRM, banking, POS + ES/EU fiscal compliance (VeriFactu, TicketBAI, Facturae). Zero-install at mcp.frihet.io. Works with Claude, ChatGPT, Cursor, Windsurf, Cline & any MCP client.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 608 KB of source, external domains: accounts.google.com, api.frihet.io, apis.google.com, app.frihet.io, docs.frihet.io, example.com, github.com, identitytoolkit.googleapis.com, login.microsoftonline.com, openai-mcp.frihet.io, securetoken.googleapis.com, us-central1-gen-lang-client-0335716041.cloudfunctions.net, www.frihet.io, www.googleapis.com, www.gstatic.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-34json

2 "name": "@frihet/mcp-server",

3 "version": "1.16.3",

4 "description": "AI-native MCP server for Frihet ERP — 157 tools: invoicing, expenses, CRM, banking, POS + ES/EU fiscal compliance (VeriFactu, TicketBAI, Facturae). Zero-install at mcp.frihet.io. Works with Claude, ChatGPT, Cursor, Windsurf, Cline & any MCP client.",

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "frihet-mcp": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc",

12 "test": "npm run build && node --test dist/__tests__/openai-profile.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js dist/__tests__/banking-tools.test.js dist/__tests__/banking-client-contract.test.js dist/__tests__/pagination-cursor-param.test.js dist/__tests__/fiscal-tools.test.js dist/__tests__/time-tools.test.js dist/__tests__/recurring-tools.test.js dist/__tests__/team-tools.test.js dist/__tests__/d4b-hr-pa ...

13 "start": "node dist/index.js",

14 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "prepublishOnly": "npm run build && npm run audit:mcp-refs -- --repo frihet-mcp",

16 "audit:mcp-refs": "node scripts/audit-mcp-refs.mjs",

17 "audit:mcp-refs:fix": "node scripts/audit-mcp-refs.mjs --fix",

18 "gate:no-leak": "bash scripts/no-public-leak.sh"

19 },

20 "keywords": [

21 "accounting",

22 "ai",

23 "ai-agent",

24 "anthropic",

25 "automation",

26 "billing",

27 "business-management",

28 "claude",

29 "clients",

30 "cline",

31 "codex",

32 "copilot",

33 "cursor",

34 "erp",

Long lines were clipped for display.

scripts/no-public-leak.shView file

•path = scripts/no-public-leak.sh kind = build_helper sizeBytes = 3453 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/no-public-leak.shView on unpkg

Source & flagged code

3 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code