registry / @frihet/mcp-server / 1.16.0

@frihet/mcp-server@1.16.0

AI-native MCP server for business management — invoices, expenses, deposits, clients, products, quotes, webhooks, CRM, e-invoicing (Facturae/XRechnung/Factur-X/FatturaPA/PEPPOL + FACe Spain B2G + TicketBAI Basque Country + KSeF Poland), vacation rentals,

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 607 KB of source, external domains: accounts.google.com, api.frihet.io, apis.google.com, app.frihet.io, docs.frihet.io, example.com, github.com, identitytoolkit.googleapis.com, login.microsoftonline.com, openai-mcp.frihet.io, securetoken.googleapis.com, us-central1-gen-lang-client-0335716041.cloudfunctions.net, www.frihet.io, www.googleapis.com, www.gstatic.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-34json

2 "name": "@frihet/mcp-server",

3 "version": "1.16.0",

4 "description": "AI-native MCP server for business management — invoices, expenses, deposits, clients, products, quotes, webhooks, CRM, e-invoicing (Facturae/XRechnung/Factur-X/FatturaPA/PEPPOL + FACe Spain B2G + TicketBAI Basque Country + KSeF Poland), vacation rentals, POS, banking, fiscal (Modelo 303/130/390/180/347/415/425/418, VeriFactu, TicketBAI, IS M200/M202), IGIC, AIEM, GL audit approval, white-label portal domain, VIES EU VAT lookup, bank rules, time tracking, recurring invoices, team management, gestoria. 157 tools. Remote endpoint at mcp.frihet.io (zero install). Works with Claud ...

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "frihet-mcp": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc",

12 "test": "npm run build && node --test dist/__tests__/openai-profile.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js

13 "start": "node dist/index.js",

14 "postinstall": "node scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "prepublishOnly": "npm run build && npm run audit:mcp-refs -- --repo frihet-mcp",

16 "audit:mcp-refs": "node scripts/audit-mcp-refs.mjs",

17 "audit:mcp-refs:fix": "node scripts/audit-mcp-refs.mjs --fix",

18 "gate:no-leak": "bash scripts/no-public-leak.sh"

19 },

20 "keywords": [

21 "accounting",

22 "ai",

23 "ai-agent",

24 "anthropic",

25 "automation",

26 "billing",

27 "business-management",

28 "claude",

29 "clients",

30 "cline",

31 "codex",

32 "copilot",

33 "cursor",

34 "erp",

Long lines were clipped for display.

scripts/no-public-leak.shView file

•path = scripts/no-public-leak.sh kind = build_helper sizeBytes = 3453 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/no-public-leak.shView on unpkg

Source & flagged code

3 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code