Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed French business due-diligence MCP that sends business identifiers and optional invoice data to a remote service, with paid calls gated by user consent.
Install only if you are comfortable sending French company identifiers and, when you choose invoice features, invoice text or IBAN data to the hosted MCP service and its disclosed server-side providers. Confirm your client enforces the stated consent prompt before any paid call, especially in automated payment workflows.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
git clone https://github.com/Vannelier/MCP-business-checker.git
cp .env.example .env # fill in your credentials
docker build -t business-checker-eu .
docker run -p 8000:8000 --env-file .env business-checker-eu
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
git clone https://github.com/Vannelier/MCP-business-checker.git
cp .env.example .env # fill in your credentials
docker build -t business-checker-eu .
docker run -p 8000:8000 --env-file .env business-checker-eu
The description states the tool returns a 'French summary,' which imposes a specific language in the skill behavior. The file does not indicate that users can opt into another language or choose locale, so this is a natural-language policy concern.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The description states the skill is for analysing a French supplier and frames its purpose entirely around French registries, which imposes a locale-specific scope. There is no explicit user choice or opt-in for language/locale, and no clear justification in the README that this regional restriction is a documented compliance-bound limitation.
No suspicious patterns detected.