finance-mcp

Caution

Score 78 / 100 · 32 files read · 0 critical, 0 high, 2 medium, 5 low findings

Report 9252b56362a4c599 · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials92

exfiltration92

execution92

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

scripts/render-demo-gif.py · line 173 · rule M1

] process = subprocess.Popen(command, stdin=subprocess.PIPE) assert process.stdin is not None for index in

low8 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

8 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

analysis/fetch.mjs · line 28 · rule L1

?? UNIVERSE; if (!process.env.SEC_USER_AGENT) { console.error('SEC_USER_AGENT is not set. Export "Your Name your@email.com" an

lowReads named environment variables (normal for API keys; listed in the permission summary)

scripts/render-demo-gif.py · line 21 · rule L1

_CANDIDATES = [ os.environ.get("FINANCE_MCP_DEMO_FONT"), "/System/Library/Fonts/SFNSMono.ttf", "/usr/share/fonts/truet

lowReads named environment variables (normal for API keys; listed in the permission summary)

scripts/smoke.mjs · line 35 · rule L1

env: { PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", SEC_USER_AGENT: process.env.SEC_USER_AGENT ?? "f

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/http.ts · line 14 · rule L1

st SEC_USER_AGENT = process.env.SEC_USER_AGENT ?? "finance-mcp contact@example.com"; export const SEC_USER_AGENT_IS_DEFAULT = !pr

Network endpoints: api.coingecko.comapi.frankfurter.devapi.worldbank.orgdata.sec.govdata.worldbank.orgefts.sec.govexample.testfinance.yahoo.comfrankfurter.devgithub.comglama.aiimg.shields.iomodelcontextprotocol.ionodejs.orgopencollective.comquery1.finance.yahoo.comquery2.finance.yahoo.comraw.githubusercontent.comregistry.npmjs.orgstatic.modelcontextprotocol.iowww.coingecko.comwww.npmjs.comwww.sec.govwww.w3.org
Environment read: FFMPEGFINANCE_MCP_DEMO_FONTHOMEPATHSEC_USER_AGENT
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/9252b56362a4c599.svg)](https://preflight.orbitaldeskllc.com/b/9252b56362a4c599)

The badge links back to this report and updates if the package is re-scanned at a new version.

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.