simplifier-mcp (simplifier-ag/simplifier-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 35 tools. No publisher has claimed this listing.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

simplifier-ag

Source: ModelScope

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
35 tools verified — handlers match their declared behaviour
21 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: SIMPLIFIER_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes35 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

businessobject-list

# List all server-side Business Objects Returns the names of every Business Object on the connected Simplifier instance. Equivalent to reading the `simplifier://businessobjects` resource; prefer the resource in clients that support MCP Resources.

businessobject-get

# Get details of a single Business Object Returns metadata, dependencies, tags, project assignments and the list of function names of a Business Object. Equivalent to reading the `simplifier://businessobject/{name}` resource; prefer the resource in clients that support MCP Resources.

businessobject-function-get

# Get details of a single Business Object function Returns parameter metadata (names, data types, aliases) and the JavaScript source code of the function. Equivalent to reading the `simplifier://businessobject/{objectName}/function/{functionName}` resource; prefer the resource in clients that suppo

businessobject-update
businessobject-function-update
businessobject-function-test
businessobject-delete

# Delete an existing Business Object

businessobject-function-delete

# Delete an existing Business Object Function

datatype-list

# List data types Returns the names, ids and categories of all data types, optionally filtered by namespace. When a `namespace` is given, only data types in that namespace are returned; otherwise root-namespace data types (including base types) are returned. Equivalent to reading the `simplifier:/

datatype-get

# Get details of a single data type Returns complete information (fields, category, description, tags, project assignments) for a data type identified by its fully qualified name. For types in the root namespace, pass just the name; for types in a namespace, pass `namespace/name` (e.g. `bo/MyBO/MyS

datatype-update
datatype-delete
server-instance-list

# List configured server instances Returns all server instances known to the connected Simplifier server, including which one is active. Useful when choosing the value for `endpoint.endpoint` in connector endpoint configurations.

server-active-instance-get

# Get the currently active server instance Returns the active Simplifier server instance. Use its `name` as the endpoint name when creating connector endpoint configurations for the server you are currently connected to. Equivalent to reading the `simplifier://server-active-instance` resource; pre

connector-list

# List all Connectors Returns names, descriptions, types, active status and call counts for every Connector on the Simplifier instance. Equivalent to reading the `simplifier://connectors` resource; prefer the resource in clients that support MCP Resources.

connector-get

# Get details of a single Connector Returns full connector configuration including endpoints, login method and metadata. Equivalent to reading the `simplifier://connector/{name}` resource; prefer the resource in clients that support MCP Resources.

connector-call-list

# List all calls of a Connector Returns the names, descriptions, parameter counts and executable flag for every call of the given Connector. Equivalent to reading the `simplifier://connector/{name}/calls` resource; prefer the resource in clients that support MCP Resources.

connector-call-get

# Get details of a single Connector call Returns full parameter information (names, data types, aliases, optionality, constant values). Equivalent to reading the `simplifier://connector/{connectorName}/call/{callName}` resource; prefer the resource in clients that support MCP Resources.

connector-update
connector-call-update
connector-wizard-rfc-create

# Create one or more calls for an RFC connector using the wizard The RFC connector requires calls to refer to existing functions on the remote SAP system. To find available functions, use the resource template `simplifier://connector-wizard/{connectorName}/search/{term}/{page}`. Select the desired

connector-call-test
connector-call-delete

# Delete a Connector call

connector-delete

# Delete a Connector

connector-wizard-rfc-search
documentation-get
logging-list
loginmethod-list

# List all Login Methods Returns names, descriptions, types and supported connectors for every Login Method. Equivalent to reading the `simplifier://loginmethods` resource; prefer the resource in clients that support MCP Resources.

loginmethod-get

# Get details of a single Login Method Returns full configuration (type, source, target, method-specific settings) for a Login Method. Equivalent to reading the `simplifier://loginmethod/{name}` resource; prefer the resource in clients that support MCP Resources.

oauthclient-list

# List all OAuth2 Clients Returns names, descriptions and mechanism information for all OAuth2 clients configured on the instance. Use the returned `name` values as `oauth2ClientName` when creating OAuth2 Login Methods via `loginmethod-update`. Equivalent to reading the `simplifier://oauthclients`

loginmethod-update
sap-system-update
sap-system-delete

# Delete an existing SAP system

sap-system-list

# List all SAP systems Returns all SAP systems configured on the connected Simplifier instance, including their instance restrictions and system type. Equivalent to reading the `simplifier://sap-systems` resource; prefer the resource in clients that support MCP Resources.

sap-system-get

# Get details of a single SAP system Returns full configuration (system id, client, application server, SNC settings, etc.) for a SAP system. SNC Quality of Protection is returned as its string form for convenience. Equivalent to reading the `simplifier://sap-system/{name}` resource; prefer the re

// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.18.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.18.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.18.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configHTTP_REQUEST_LOG_FILE
configRUNNING_IN_DOCKER
configSIMPLIFIER_BASE_URLclaude mcp add simplifier npx @simplifierag/simplifier-mcp@latest --env SIMPLIFIER_TOKEN=<your current simplifier token> --env =https://<yourinstance>-dev.simplifier.cloud
configSIMPLIFIER_CREDENTIALS_FILE
configSIMPLIFIER_SKIP_CONNECTION_TEST
🔐 secretSIMPLIFIER_TOKENclaude mcp add simplifier npx @simplifierag/simplifier-mcp@latest --env =<your current simplifier token> --env SIMPLIFIER_BASE_URL=https://<yourinstance>-dev.simplifier.cloud
// quality suggestions

Tool inputs are validated

28/35 tool handlers declare input schemas (80%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.18.1 (high), @modelcontextprotocol/sdk@1.18.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @simplifierag doesn't match GitHub owner simplifier-ag

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/simplifier-ag/simplifier-mcp?variant=verified)](https://m8ven.ai/mcp/simplifier-ag/simplifier-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: e84250748c37916c91f50b87afd5c22454864769
code hash: a7ecf754f65581f2e902d9a70f97cfa7a905ef856d16e7c35540b513359b1983
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client