# io.github.Fluke-Studio/uk-business-intelligence > Enrich any UK business with Companies House, Google Places, DNS, and social data. - name: io.github.Fluke-Studio/uk-business-intelligence - version: 0.1.3 - connection class: L0 (run_local_package) - trust: 76/100 - quality: –/100 (not scored) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/io.github.Fluke-Studio%2Fuk-business-intelligence - tools: https://api.protogrid.dev/v1/servers/io.github.Fluke-Studio%2Fuk-business-intelligence/tools **Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it. ## Connection (mcpServers) ```json { "mcpServers": { "uk-business-intelligence": { "command": "npx", "args": [ "-y", "uk-business-intelligence-mcp@0.1.3" ], "env": { "SUPABASE_URL": "${SUPABASE_URL}", "SUPABASE_SERVICE_ROLE_KEY": "${SUPABASE_SERVICE_ROLE_KEY}", "COMPANIES_HOUSE_API_KEY": "${COMPANIES_HOUSE_API_KEY}", "GOOGLE_PLACES_API_KEY": "${GOOGLE_PLACES_API_KEY}" } } } } ``` Placeholders to fill: `${SUPABASE_SERVICE_ROLE_KEY}`, `${COMPANIES_HOUSE_API_KEY}`, `${GOOGLE_PLACES_API_KEY}`. ## Trust - hygiene: 100 - liveness: n/a - freshness: 45 - provenance: 80 - drivers: +repository +namespace-matches-repo ~liveness-unmeasured -stale-213d - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality –/100 (not scored) Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package. ### protocol: n/a (weight 25) - n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only) ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: n/a (weight 30) - n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty) ### stability: n/a (weight 15) - n/a `stability.changes`, `stability.rug_pull`: tool list unknown ### dependencies: 33 (weight 15) - fail `deps.known_vulns`: 13 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-2xp9-vwfh-vxw4 in next@14.2.35 (direct, fixed in 15.5.24), GHSA-36qx-fr4f-26g5 in next@14.2.35 (direct, fixed in 15.5.16), GHSA-89xv-2m56-2m9x in next@14.2.35 (direct, fixed in 15.5.21), ...; 15 more of lower severity or without a fix - fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later - pass `deps.resolvable`: uk-business-intelligence-mcp@0.1.3 resolved: 141 packages - tools: unknown - badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Fluke-Studio/uk-business-intelligence.svg)](https://protogrid.dev/servers/io.github.Fluke-Studio/uk-business-intelligence) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes _No tool definition changes recorded._ ## Dependencies - npm uk-business-intelligence-mcp@0.1.3: resolved, 140 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1 - GHSA-2xp9-vwfh-vxw4 (critical) in `` next@14.2.35 ``, direct, fixed in `` 15.5.24 ``, advisory summary: "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used" https://osv.dev/vulnerability/GHSA-2xp9-vwfh-vxw4 - GHSA-p293-qw3h-jr36 (critical) in `` next@14.2.35 ``, direct, fixed in `` 15.5.24 ``, advisory summary: "Next.js: Unauthenticated Remote Code Execution on windows-hosted servers" https://osv.dev/vulnerability/GHSA-p293-qw3h-jr36 - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h - GHSA-36qx-fr4f-26g5 (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n" https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5 - GHSA-89xv-2m56-2m9x (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Server-Side Request Forgery in Server Actions on custom servers" https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x - GHSA-8h8q-6873-q5fj (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js Vulnerable to Denial of Service with Server Components" https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj - GHSA-c4j6-fc7j-m34r (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades" https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r - GHSA-h25m-26qc-wcjf (high) in `` next@14.2.35 ``, direct, fixed in `` 15.0.8 ``, advisory summary: "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components" https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf - GHSA-m99w-x7hq-7vfj (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Denial of Service in App Router using Server Actions" https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj - GHSA-p9j2-gv94-2wf4 (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname" https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 - GHSA-q4gf-8mx6-v5v3 (high) in `` next@14.2.35 ``, direct, fixed in `` 15.5.15 ``, advisory summary: "Next.js has a Denial of Service with Server Components" https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 - GHSA-6g55-p6wh-862q (high) in `` postcss@8.4.31 ``, indirect, fixed in `` 8.5.12 ``, advisory summary: "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments" https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q - GHSA-r28c-9q8g-f849 (high) in `` postcss@8.4.31 ``, indirect, fixed in `` 8.5.18 ``, advisory summary: "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure" https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849 - GHSA-68fv-2mgg-jv7q (high) in `` source-map-js@1.2.1 ``, indirect, fixed in `` 1.2.2 ``, advisory summary: "source-map-js allows event-loop denial of service through indexed source-map section offsets" https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q - GHSA-3x4c-7xq6-9pq8 (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.14 ``, advisory summary: "Next.js: Unbounded next/image disk cache growth can exhaust storage" https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 - GHSA-4633-3j49-mh5q (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences" https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q - GHSA-4c39-4ccg-62r3 (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Unbounded Server Action payload in Edge runtime" https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 - GHSA-68g3-v927-f742 (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Cache confusion of response bodies for requests with bodies" https://osv.dev/vulnerability/GHSA-68g3-v927-f742 - GHSA-955p-x3mx-jcvp (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.21 ``, advisory summary: "Next.js: Unauthenticated disclosure of internal Server Function endpoints" https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp - GHSA-9g9p-9gw9-jx7f (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.10 ``, advisory summary: "Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration" https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f - GHSA-ffhc-5mcf-pf4q (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces" https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q - GHSA-ggv3-7p47-pfv8 (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.13 ``, advisory summary: "Next.js: HTTP request smuggling in rewrites" https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 - GHSA-gx5p-jg67-6x7h (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js has cross-site scripting in beforeInteractive scripts with untrusted input" https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h - GHSA-h64f-5h5j-jqjh (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js has a Denial of Service in the Image Optimization API" https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh - GHSA-wfc6-r584-vfw7 (moderate) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js vulnerable to cache poisoning in React Server Component responses" https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 - GHSA-fxqj-rqcc-2cmp (moderate) in `` postcss@8.4.31 ``, indirect, fixed in `` 8.5.23 ``, advisory summary: "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when \`from\` is unset" https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp - GHSA-qx2v-qp2m-jg93 (moderate) in `` postcss@8.4.31 ``, indirect, fixed in `` 8.5.10 ``, advisory summary: "PostCSS has XSS via Unescaped \ in its CSS Stringify Output" https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 - GHSA-3g8h-86w9-wvmq (low) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js's Middleware / Proxy redirects can be cache-poisoned" https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq - GHSA-vfv6-92ff-j949 (low) in `` next@14.2.35 ``, direct, fixed in `` 15.5.16 ``, advisory summary: "Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting" https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. ## Remotes _none_ ## Packages - npm uk-business-intelligence-mcp@0.1.3 secrets: SUPABASE_SERVICE_ROLE_KEY, COMPANIES_HOUSE_API_KEY, GOOGLE_PLACES_API_KEY ## Tools (0) _none observed_