14
grade F
2 days ago
npm
tomaspavlin/rohlik-mcp
MCP server for controlling Rohlik.cz grocery shopping website
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: ROHLIK_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
ROHLIK_BASE_URL— "": "https://www.rohlik.cz"config
ROHLIK_DEBUG— "": "true"🔐 secret
ROHLIK_PASSWORD— "": "your-password",config
ROHLIK_USERNAME— "": "your-email@example.com",// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/tomaspavlin-rohlik-mcp-1xs582)commit: 9e824c5b1dba20885b77e2840e1cf90c20a28c92
code hash: 48646122f70404e18d1a487d4d0f7c8082f42d16a457920261577fff18ea6909
verified: 4/18/2026, 4:19:47 PM