Back to MCP Trust Indexm8ven
70
/ 100
1 month ago
glama

koko-call-mcp

Read-only MCP server for searching Japanese government procurement bid notices (官公需) from the SME Agency's KKJ portal. Includes AI ranking, PDF requirement extraction, and CSV/calendar export.

→ sugukurukabe/koko-call-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: GMO_BANK_ACCESS_TOKEN, MONEYFORWARD_OAUTH_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
🔐
You'll be asked for 7 credentials: ANTHROPIC_API_KEY, GATEWAY_APPROVAL_HMAC_SECRET, GATEWAY_JWT_SECRET, GMO_BANK_ACCESS_TOKEN, JP_BIDS_OAUTH_SECRET, MONEYFORWARD_OAUTH_TOKEN, STRIPE_SECRET_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALLOWED_ORIGINS
🔐 secretANTHROPIC_API_KEY
configGATEWAY_ALLOW_LOCAL_CHILD_ENDPOINTS
🔐 secretGATEWAY_APPROVAL_HMAC_SECRET
configGATEWAY_CHILD_TOKEN_FREEE
configGATEWAY_CHILD_TOKEN_JP_BIDS
configGATEWAY_ENABLE_BETA_PRO
🔐 secretGATEWAY_JWT_SECRET
configGATEWAY_PRO_API_KEYS
configGATEWAY_PUBLIC_URL
configGATEWAY_ROUTER_LLM_FALLBACK
🔐 secretGMO_BANK_ACCESS_TOKEN
configGMO_BANK_API_BASE_URL
configGMO_BANK_MCP_URL
configGOOGLE_CLOUD_LOCATION
configGOOGLE_CLOUD_PROJECT
configHOUJIN_BANGOU_API_VERSION
configHOUJIN_BANGOU_APPLICATION_ID
configHTTP_HOST
configJP_BIDS_BASE_URL
configJP_BIDS_BRAND_ATTRIBUTION
configJP_BIDS_BRAND_CONTACT
configJP_BIDS_BRAND_NAME
configJP_BIDS_BRAND_ORG
configJP_BIDS_BRAND_SHORT_NAME
configJP_BIDS_BRAND_URL
configJP_BIDS_GCP_PROJECT
configJP_BIDS_GCP_REGION
🔐 secretJP_BIDS_OAUTH_SECRET
configJP_BIDS_PDF_ALLOWED_HOSTS
configJP_BIDS_PDF_MAX_BYTES
configJP_BIDS_PDF_TIMEOUT_MS
configJP_BIDS_PRO_API_KEYS
configJP_BIDS_RATE_LIMIT_PER_SECOND
configJP_BIDS_REMOTE_DOMAIN
configJP_BIDS_REMOTE_EXTRACTION_FETCH
configJP_BIDS_REMOTE_EXTRACTION_PREFECTURE
configJP_BIDS_REMOTE_EXTRACTION_QUERY
configJP_BIDS_REMOTE_EXTRACTION_TARGET_URI
configJP_BIDS_REMOTE_EXTRACTION_VERBOSE
configJP_BIDS_REMOTE_MCP_URL
configJP_BIDS_REMOTE_ORIGIN
configJP_BIDS_REMOTE_URL
configJP_BIDS_VERTEX_AI
configJP_BIDS_VERTEX_DAILY_BUDGET_USD
configJP_BIDS_VERTEX_ESTIMATED_COST_PER_CALL_USD
configJP_BIDS_VERTEX_LOCATION
configJP_BIDS_VERTEX_MODEL
configKOKO_CALL_RATE_LIMIT_PER_SECOND
configK_SERVICE
configMONEYFORWARD_ENDPOINT
🔐 secretMONEYFORWARD_OAUTH_TOKEN
configPORT
configRUN_LIVE_KKJ_CHECK
configSTRIPE_DEFAULT_CUSTOMER_ID
🔐 secretSTRIPE_SECRET_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 9 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/sugukurukabe-koko-call-mcp-2brwja)](https://m8ven.ai/mcp/sugukurukabe-koko-call-mcp-2brwja)
commit: 8e7358f9f5a7becb8820c42d737591d779efb08f
code hash: d7347b53e84554ee39c604fb61a5dbe08be03d98a8eaea769c8159a32e19493c
verified: 6/15/2026, 1:37:06 PM
view raw JSON →