Frihet MCP Server
@frihet/mcp-server
npm
v1.17.0
Published by @frihet — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
AI-native MCP server for Frihet ERP — 157 tools: invoicing, expenses, CRM, banking, POS + ES/EU fiscal compliance (VeriFactu, TicketBAI, Facturae). Zero-install at mcp.frihet.io. Works with Claude, ChatGPT, Cursor, Windsurf, Cline & any MCP client.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Package runs install-time scripts MTC-SUP-010 | supply-chain |
2. Client adoption risk — 99 − 7 = 92. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 6
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: get_invoice_einvoice ⇒ create_webhook → delete_webhook. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow get_invoice_einvoice → create_webhook → delete_webhook
high Read-and-egress in one tool: "create_webhook"MTC-FLOW-003
Tool "create_webhook" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.
Fix: Separate reading from sending; require explicit user confirmation before egress of file/secret contents.
Location: flow create_webhook
high Read-and-egress in one tool: "update_webhook"MTC-FLOW-003
Tool "update_webhook" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.
Fix: Separate reading from sending; require explicit user confirmation before egress of file/secret contents.
Location: flow update_webhook
medium Unconstrained URL/host parameter "url" on "create_webhook"MTC-CAP-007
Tool "create_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool create_webhook · inputSchema.properties.url
medium Unconstrained URL/host parameter "url" on "update_webhook"MTC-CAP-007
Tool "update_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool update_webhook · inputSchema.properties.url
low Package runs install-time scripts (postinstall)MTC-SUP-010
"@frihet/mcp-server" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.
Evidence: node scripts/postinstall.js || true
Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.
Location: package @frihet/mcp-server
Tools 157
Each tool and what it can reach — statically extracted from the published source.
create_webhooknetwork egressreads sensitive dataupdate_webhooknetwork egressreads sensitive datadelete_webhooknetwork egressget_invoice_einvoiceingests untrusted inputtest_webhooknetwork egressanomaly_listno sensitive capabilityapply_depositno sensitive capabilityapply_late_feeno sensitive capabilityattendance_clock_inno sensitive capabilityattendance_clock_outno sensitive capability
Show 147 more tools ↓
categorize_transactionno sensitive capabilitycreate_clientno sensitive capabilitycreate_client_contactno sensitive capabilitycreate_client_noteno sensitive capabilitycreate_credit_noteno sensitive capabilitycreate_depositno sensitive capabilitycreate_expenseno sensitive capabilitycreate_invoiceno sensitive capabilitycreate_productno sensitive capabilitycreate_quoteno sensitive capabilitycreate_recurring_invoiceno sensitive capabilitycreate_reservationno sensitive capabilitycreate_time_entryno sensitive capabilitycreate_vendorno sensitive capabilitydelete_clientno sensitive capabilitydelete_client_contactno sensitive capabilitydelete_client_noteno sensitive capabilitydelete_depositno sensitive capabilitydelete_expenseno sensitive capabilitydelete_invoiceno sensitive capabilitydelete_productno sensitive capabilitydelete_quoteno sensitive capabilitydelete_recurring_invoiceno sensitive capabilitydelete_time_entryno sensitive capabilitydelete_vendorno sensitive capabilityduplicate_invoiceno sensitive capabilityeinvoice_exportno sensitive capabilityexport_datevno sensitive capabilityface_statusno sensitive capabilityface_submitno sensitive capabilityfrihet_aiem_calculateno sensitive capabilityfrihet_bank_rule_createno sensitive capabilityfrihet_bank_rules_listno sensitive capabilityfrihet_gl_entry_approveno sensitive capabilityfrihet_gl_entry_audit_logno sensitive capabilityfrihet_gl_entry_rejectno sensitive capabilityfrihet_modelo_200_summaryno sensitive capabilityfrihet_modelo_202_summaryno sensitive capabilityfrihet_modelo_415_summaryno sensitive capabilityfrihet_modelo_418_summaryno sensitive capabilityfrihet_modelo_425_summaryno sensitive capabilityfrihet_portal_domain_addno sensitive capabilityfrihet_portal_domain_removeno sensitive capabilityfrihet_portal_domain_verifyno sensitive capabilityfrihet_portal_onboard_link_generateno sensitive capabilityfrihet_tax_id_vies_lookupno sensitive capabilitygestoria_aging_consolidatedno sensitive capabilitygestoria_message_sendno sensitive capabilitygestoria_messages_listno sensitive capabilitygestoria_template_bulk_sendno sensitive capabilitygestoria_template_createno sensitive capabilityget_bank_accountno sensitive capabilityget_business_contextno sensitive capabilityget_clientno sensitive capabilityget_depositno sensitive capabilityget_einvoice_statusno sensitive capabilityget_expenseno sensitive capabilityget_invoiceno sensitive capabilityget_invoice_pdfno sensitive capabilityget_kitchen_ticketno sensitive capabilityget_modelo_130_summaryno sensitive capabilityget_modelo_180_summaryno sensitive capabilityget_modelo_303_summaryno sensitive capabilityget_modelo_347_summaryno sensitive capabilityget_modelo_390_summaryno sensitive capabilityget_monthly_summaryno sensitive capabilityget_productno sensitive capabilityget_quarterly_taxesno sensitive capabilityget_quoteno sensitive capabilityget_recurring_invoiceno sensitive capabilityget_reservationno sensitive capabilityget_saleno sensitive capabilityget_time_entryno sensitive capabilityget_time_summaryno sensitive capabilityget_vendorno sensitive capabilityget_webhookno sensitive capabilityinvite_team_memberno sensitive capabilitykitchen_flow_summaryno sensitive capabilityksef_submitno sensitive capabilityleave_approveno sensitive capabilityleave_cancelno sensitive capabilityleave_listno sensitive capabilityleave_rejectno sensitive capabilityleave_request_createno sensitive capabilitylist_bank_accountsno sensitive capabilitylist_client_activitiesno sensitive capabilitylist_client_contactsno sensitive capabilitylist_client_notesno sensitive capabilitylist_clientsno sensitive capabilitylist_depositsno sensitive capabilitylist_expensesno sensitive capabilitylist_invoicesno sensitive capabilitylist_kitchen_stationsno sensitive capabilitylist_kitchen_ticketsno sensitive capabilitylist_menu_itemsno sensitive capabilitylist_productsno sensitive capabilitylist_propertiesno sensitive capabilitylist_quotesno sensitive capabilitylist_recurring_invoicesno sensitive capabilitylist_reservationsno sensitive capabilitylist_salesno sensitive capabilitylist_team_membersno sensitive capabilitylist_terminalsno sensitive capabilitylist_time_entriesno sensitive capabilitylist_transactionsno sensitive capabilitylist_vendorsno sensitive capabilitylist_webhooksno sensitive capabilitylog_client_activityno sensitive capabilitymark_invoice_paidno sensitive capabilitymatch_transaction_to_invoiceno sensitive capabilityonboarding_persona_setno sensitive capabilityonboarding_statusno sensitive capabilityovertime_reportno sensitive capabilitypause_recurring_invoiceno sensitive capabilitypayroll_checklistno sensitive capabilitypayroll_exportno sensitive capabilityperiod_closeno sensitive capabilityperiod_close_statusno sensitive capabilityperiod_reopenno sensitive capabilitypermissions_matrixno sensitive capabilitypermissions_meno sensitive capabilityrefund_depositno sensitive capabilityrefund_saleno sensitive capabilityremove_team_memberno sensitive capabilityresume_recurring_invoiceno sensitive capabilityrun_recurring_nowno sensitive capabilitysearch_invoicesno sensitive capabilitysend_einvoiceno sensitive capabilitysend_invoiceno sensitive capabilitysend_quoteno sensitive capabilitysync_channelno sensitive capabilityticketbai_statusno sensitive capabilityticketbai_submitno sensitive capabilityupdate_clientno sensitive capabilityupdate_depositno sensitive capabilityupdate_expenseno sensitive capabilityupdate_invoiceno sensitive capabilityupdate_kitchen_ticketno sensitive capabilityupdate_productno sensitive capabilityupdate_quoteno sensitive capabilityupdate_recurring_invoiceno sensitive capabilityupdate_team_member_roleno sensitive capabilityupdate_time_entryno sensitive capabilityupdate_vendorno sensitive capabilityvalidate_einvoice_xmlno sensitive capabilityverifactu_resubmitno sensitive capabilityverifactu_statusno sensitive capability
Toxic flows 3
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (157 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 4
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.17.0 latest |
A 92/100 | 6 | 1.13.0 | 2026-09-07 |
v1.16.6 |
A 92/100 | 6 | 1.13.0 | 2026-08-30 |
v1.16.5 |
A 92/100 | 6 | 1.12.1 | 2026-08-06 |
v1.16.4 |
A 92/100 | 6 | 1.12.1 | 2026-07-29 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @frihet/mcp-server --onlineMore in Business & CRM
Free public tax reference data — GST/VAT, income, company and capital-gains tax rules for 50+ countries.
The approval gate for unattended UCP buying agents — a policy/approval MCP proxy in front of a merchant's UCP checkout endpoint.
Autotask PSA MCP server. Generic entity query/get/create/update across the full REST API plus convenience tools for tickets, companies, contacts, projects, tasks and time entries. AI-safe with readonly mode and destructive-action confirmation. stdio + opt
MCP server for B2C Commerce developer experience tools
Search, compare and contact real-world companies through a public MCP business directory.
Norwegian business register (Brønnøysundregistrene) as an MCP server — companies, roles, subunits and annual accounts, with the register's silent traps encoded as guards.