fund-mcp111

Item: fund-mcp111
Rating: 62
Author: M8ven

一个基于 Model Context Protocol (MCP) 的基金知识库服务器，提供基金相关知识的查询和检索功能。 Fund MCP Server 是一个专门为基金投资领域设计的 MCP 服务器，通过集成外部知识库 API，为用户提供基金知识查询服务。该服务器支持多种部署模式，包括标准 MCP 协议、HTTP REST API 和 Server-Sent Events (SSE) 模式。 - 基金知识查询: 通过关键词搜索基金相关知识库 - 多协议支持: 支持 MCP 标准协议、HTTP REST API 和 SSE - 灵活部署: 支持本地部署、Docker 部署和生产环境部署 - 跨平台: 支持 Windows、Linux 和 macOS - 基于 TypeScript 开发，类型安全 - 使用 Zod 进行参数验证 - 支持环境变量配置 - 提供健康检查和监控接

→ zhenzp/fund-mcp-server · listed on modelscope

Caution. Findings were deducted from the grade — details on the listing. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for the top badge — read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Verified

Install from

modelscope

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: FUND_KB_API_URL. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

// known CVEs in dependencies2 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.9.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.9.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowexpress@4.18.2GHSA-qw6h-vgh9-j6wx

express vulnerable to XSS via response.redirect()

lowexpress@4.18.2GHSA-rv95-896h-c2vc

Express.js Open Redirect in malformed URLs

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run. Since this is a local server, you set these in your own MCP client configuration and they stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configFUND_KB_API_URL

configMCP_TRANSPORT— stdio MCP 传输模式

configPORT— 3000 服务监听端口

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/zhenzp-fund-mcp-server-1hddxp?variant=verified)](https://m8ven.ai/mcp/zhenzp-fund-mcp-server-1hddxp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 33ab4325f41ec4999796f26e449687d9b47a3de1

code hash: e820f20b322521bc0daf6623d9773f558f367013e851ee39b5e75e45339ea26b

verified: 8/13/2026, 10:49:55 PM

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client