Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
mcp_so

Kash Business management assistant

Kash.click management assistant. Connect your assistant to your business complete sales history, clients, payments, tax information, employees, points of sales. \r\n

→ paracetamol951/caisse-enregistreuse-mcp-server· listed on mcp_so
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

mcp.so

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
36 tools verified — handlers match their declared behaviour
5 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: APIKEY, MCP_APIKEY, MCP_JWT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies5 high6 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.2.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.2.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highundici@6.19.8GHSA-f269-vfmq-vjvj

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

highundici@6.19.8GHSA-v9p9-hfj2-hcw8

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

highundici@6.19.8GHSA-vrm6-8vpv-qv8q

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAPIKEY— Already have one? Retrieve your and SHOPID in the software under Setup → Webservices or connect using oAuth.
configAPI_BASE
🔐 secretMCP_APIKEY
configMCP_AUTH_WS_BASE
🔐 secretMCP_JWT_SECRET
configMCP_LANG— Tool titles and descriptions are available in English and French, resolved automatically from the Accept-Language header or the environment variable.
configMCP_OAUTH_AUDIENCE
configMCP_OAUTH_CLIENT_ID
configMCP_OAUTH_ISSUER
configMCP_OAUTH_PRIVATE_KEY_PEM
configMCP_OAUTH_PUBLIC_KEY_PEM
configMCP_OAUTH_REDIRECT_URI
configMCP_SHOPID
configMCP_TOKENS
configPORT
configREDIS_NAMESPACE
configREDIS_URL
configSHOPID— Already have one? Retrieve your APIKEY and in the software under Setup → Webservices or connect using oAuth.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/paracetamol951-caisse-enregistreuse-mcp-server-15cjhf)](https://m8ven.ai/mcp/paracetamol951-caisse-enregistreuse-mcp-server-15cjhf)
commit: 77cd4a57afc7fa227a8917ed69b786804b87b9d4
code hash: 7a3a97030d665a8883afa29de0fc6870b0e113758a057886120931d5ccc3ef4f
verified: 6/13/2026, 9:47:05 AM
view raw JSON →