Back to MCP Trust Indexm8ven
46
/ 100
1 month ago
glama

Stock MCP

Unifies inventory data from four sources (Jikeyun, Supor factory, WeChat Excel, RPA) with timestamps, and exposes MCP tools for AI agents to query stock levels.

→ huohou0418/stock-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
5 tools verified — handlers match their declared behaviour
4 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 11 credentials: BAOJIA_WEBHOOK_TOKEN, JKY_APP_KEY, JKY_APP_SECRET, JKY_MCP_TOKEN, MCP_SSE_TOKEN, PG_PASSWORD, REDIS_PASSWORD, RPA_JKY_APP_KEY, RPA_JKY_APP_SECRET, SUPOR_APP_KEY, WECHAT_XLSX_WEBHOOK_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies5 high4 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highdrizzle-orm@0.34.1GHSA-gpj5-g38j-94v9

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

highxlsx@0.18.5GHSA-4r6h-8v6p-xvw6

Prototype Pollution in sheetJS

highxlsx@0.18.5GHSA-5pgg-2g8v-p4x9

SheetJS Regular Expression Denial of Service (ReDoS)

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAPP_CORS_ORIGINS
configAPP_GLOBAL_PREFIX
configAPP_NAME
configAPP_PORT
🔐 secretBAOJIA_WEBHOOK_TOKEN
configBAOJIA_WEBHOOK_URL
configBAOJIA_WECHAT_PULL_URL
configDINGTALK_AT_MOBILES
configDINGTALK_ENABLED
configDINGTALK_WEBHOOK_URL
configINVENTORY_CACHE_TTL
configINVENTORY_REFRESH_GUARD_MINUTES
configINVENTORY_REQUIRE_AS_OF— 强制三层时间戳——as_of(必填) / ingested_at / created_at；=true 时缺 as_of 抛错
configINVENTORY_STALE_MINUTES
configJKY_API_BASE
🔐 secretJKY_APP_KEY
🔐 secretJKY_APP_SECRET
configJKY_BATCH_SIZE
configJKY_DEFAULT_PRIORITY
configJKY_ENABLED
configJKY_MCP_ENDPOINT
🔐 secretJKY_MCP_TOKEN
configJKY_REQUEST_INTERVAL_MS
configJKY_ROBOT_CODE
configJKY_WAREHOUSE_CODES
configLOG_LEVEL
configLOG_PRETTY
configMCP_SSE_ENABLED
configMCP_SSE_PATH
🔐 secretMCP_SSE_TOKEN
configMCP_STDIO_ENABLED
configPG_CONNECTION_TIMEOUT_MS
configPG_DATABASE
configPG_HOST
configPG_IDLE_TIMEOUT_MS
🔐 secretPG_PASSWORD
configPG_POOL_MAX
configPG_PORT
configPG_SCHEMA
configPG_SSL
configPG_USER
configREDIS_DB
configREDIS_HOST
configREDIS_KEY_PREFIX
🔐 secretREDIS_PASSWORD
configREDIS_PORT
configREDIS_TTL_DEFAULT
configRPA_ALERT_ON_NO_REPLY_ENABLED
🔐 secretRPA_JKY_APP_KEY
🔐 secretRPA_JKY_APP_SECRET
configRPA_JKY_ROBOT_CODE
configRPA_JKY_TIMEOUT_MS
configRPA_MAX_RETRIES
configRPA_RETRY_INTERVAL_MINUTES
configSUPOR_API_BASE
🔐 secretSUPOR_APP_KEY
configSUPOR_AUTH_ERROR_ALERT_ENABLED
configSUPOR_CRON
configSUPOR_CSV_COL_ASOF
configSUPOR_CSV_COL_QTY
configSUPOR_CSV_COL_SKU
configSUPOR_CSV_COL_WAREHOUSE
configSUPOR_CSV_PATH
configSUPOR_METHOD
configSUPOR_MODE— 苏泊尔工厂 cron（每 2h）+ 按需补数 ✅ mock 可用；切 =httpcsv
configSUPOR_RETRY_BACKOFF_MS
configSUPOR_RETRY_MAX
configSUPOR_TIMEOUT_MS
configSUPOR_WAREHOUSES
configSUPPLIER_INVENTORY_POLL_CRON
configSUPPLIER_INVENTORY_POLL_ENABLED
configSUPPLIER_REMINDER_CRON
configSUPPLIER_REMINDER_ENABLED
configSUPPLIER_REMINDER_RPA_ENDPOINT
configSUPPLIER_REMINDER_TEMPLATE
configTHROTTLE_LIMIT
configTHROTTLE_TTL
🔐 secretWECHAT_XLSX_WEBHOOK_TOKEN
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/huohou0418-stock-mcp-qmsz89)](https://m8ven.ai/mcp/huohou0418-stock-mcp-qmsz89)
commit: e0cdbfa49bf0578742183dd6528e806639ba917c
code hash: 1f49de42fbcdf1452593c1e2409673bfaa6b7f9996c3285c50920d356218cd65
verified: 6/29/2026, 11:17:06 AM
view raw JSON →