Is io.github.BigRedCloud/red-mcp-server safe to use?

io.github.BigRedCloud/red-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install io.github.BigRedCloud/red-mcp-server?

io.github.BigRedCloud/red-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.BigRedCloud/red-mcp-server do?

io.github.BigRedCloud/red-mcp-server provides 12 tools: failedCompanies, ready, not_ready, Features, Architecture and 7 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.BigRedCloud/red-mcp-server?

io.github.BigRedCloud/red-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.BigRedCloud/red-mcp-server actively maintained?

io.github.BigRedCloud/red-mcp-server is actively maintained — last commit was 4 days ago.

io.github.BigRedCloud/red-mcp-server

npm

Secure MCP access to Big Red Cloud accounting data, workflows, help and training.

15.5M/wk 12 tools GitHub npm

No known CVEs

Apache-2.0 license

Actively maintained

Last commit 4d ago

Works with most clients

Transport:

12 tools · ~379 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 3h ago

Edit this pageView history

io.github.BigRedCloud/red-mcp-server is an MCP server that secure MCP access to Big Red Cloud accounting data, workflows, help and training. Its tool list has not been published yet, requires no API key, and scores 86/100 on MCPpedia's security, maintenance and efficiency rubric.

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "red-mcp-server": {
      "env": {
        "BRC_API_BASE_URL": "https://app.bigredcloud.com/api"
      },
      "args": [
        "build/index.js"
      ],
      "command": "node"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-bigredcloud-red-mcp-server)](https://mcppedia.org/s/io-github-bigredcloud-red-mcp-server)

Read me

What io.github.BigRedCloud/red-mcp-server does

Red is an open-source Model Context Protocol (MCP) server that connects AI assistants and MCP clients to Big Red Cloud accounting data through a set of controlled MCP tools.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

86/100across 5 weighted dimensions

How we score →

0255075100

−14

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

8 fixed

CVE-2022-29244high · fixedCVSS 7.5

Packing does not respect root-level ignore files in workspaces

### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include. ### Patch - Up

Affected: >= 7.9.0Fixed in 8.11.0source →

CVE-2018-7408high · fixedCVSS 7.8

Incorrect Permission Assignment for Critical Resource in NPM

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

Affected: >= 0Fixed in 5.7.1source →

CVE-2013-4116low · fixed

Local Privilege Escalation in npm

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.

Affected: >= 0Fixed in 1.3.3source →

CVE-2020-15095medium · fixedCVSS 4.4

npm CLI exposing sensitive information through logs

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.

Affected: >= 0Fixed in 6.14.6source →

CVE-2019-16777high · fixedCVSS 7.7

npm Vulnerable to Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory. This b

Affected: >= 0Fixed in 6.13.4source →

Inventory

Tools (12)

Click any tool to inspect its schema.

~379 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.BigRedCloud/red-mcp-server safe to use?: io.github.BigRedCloud/red-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install io.github.BigRedCloud/red-mcp-server?: io.github.BigRedCloud/red-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.BigRedCloud/red-mcp-server do?: io.github.BigRedCloud/red-mcp-server provides 12 tools: failedCompanies, ready, not_ready, Features, Architecture and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.BigRedCloud/red-mcp-server?: io.github.BigRedCloud/red-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.BigRedCloud/red-mcp-server actively maintained?: io.github.BigRedCloud/red-mcp-server is actively maintained — last commit was 4 days ago.

Similar servers

Others in finance

View all →

Alpha Vantage Mcp93

Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators

202 3

io.github.chrischall/honeybook-mcp92

HoneyBook client-portal MCP server for Claude — view contracts and invoices from wedding vendors

1 6

io.github.rustok-org/rustok-wallet92

Self-custody Ethereum agent wallet (MCP/stdio). Keys stay in a local Docker volume.

io.github.wyre-technology/qbo-mcp92

MCP server for QuickBooks Online — accounts, customers, invoices, bills, and reports.

2 11

MCP Security Weekly

Get CVE alerts and security updates for io.github.BigRedCloud/red-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "red-mcp-server": {
      "env": {
        "BRC_API_BASE_URL": "https://app.bigredcloud.com/api"
      },
      "args": [
        "build/index.js"
      ],
      "command": "node"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-bigredcloud-red-mcp-server)](https://mcppedia.org/s/io-github-bigredcloud-red-mcp-server)

Read me

What io.github.BigRedCloud/red-mcp-server does

Red is an open-source Model Context Protocol (MCP) server that connects AI assistants and MCP clients to Big Red Cloud accounting data through a set of controlled MCP tools.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Red MCP Server

Red is an open-source Model Context Protocol (MCP) server that connects AI assistants and MCP clients to Big Red Cloud accounting data through a set of controlled MCP tools.

Supported customer platforms today are ChatGPT, Claude, and Mistral (including Vibe). Other MCP clients may work technically, but they are not treated as officially supported platforms. Red uses platform detection only for anonymous operational telemetry (see Privacy-safe telemetry).

Instead of calling the Big Red Cloud REST API directly, users work in plain language. The server translates requests into structured API calls and applies safety checks around anything that changes data.

With Red, a connected user can:

Review Big Red Cloud data with read-only lookups (customers, suppliers, products, invoices, quotes, nominal reports, and more).
Review before posting — see a plain-English preview of new or changed records before anything is written to Big Red Cloud.
Create, update, delete, batch, or email records only after explicit confirmation (and only when those capabilities are enabled for the deployment).
Ask Big Red Cloud how-to and training questions — Red answers using official support articles, customer documentation, screenshots, and webinar resources. These help tools do not require a connected company.

Why open source?

We believe AI infrastructure should be transparent. Customers should be able to inspect the software that connects their accounting data to AI assistants.

Our competitive advantage is not the connector itself; it is our accounting platform, our expert bookkeeping advice, our customer experience, and the value we build on top of it.

By open-sourcing Red, we hope to encourage trust, community contributions, and wider adoption of open standards.

Features

Secure company connection flow (one-time connection page; no credentials in chat)
Pre-confirm validation of company connection credentials on the connection page (single-company form or multi-company CSV upload)
Partial connection results — invalid keys are rejected before confirm and reported in failedCompanies
Hosted HTTP connectionRef / activeConnectionRef so MCP clients can silently reuse a confirmed connection across supported session changes; kept in tool JSON, not shown to end users
Request routing for transactional work — action tools expect a short-lived routeToken from the router before create/update/delete/batch/email workflows proceed
Privacy-safe anonymous operational telemetry (platform, environment, tool name, connected-company count) — see docs/TELEMETRY.md
Company readiness check (brc_company_readiness_check) for connected companies
Read-only Big Red Cloud lookups
Customer, supplier, product, sales rep, VAT, and analysis category tools
Sales quotes, invoices, credit notes, purchases, payments, and cash tools
Preview-before-posting confirmation flow for create, update, delete, and batch actions (email tools use an explicit send confirmation)
VAT and transaction safety checks
Sales invoice safeguards, including multi-line generated-reference validation, Gross Price Entry priceBasis handling, Sales VAT category validation, placeholder product ID blocking, and related preflight checks
Session audit log of writes made through the MCP session, plus a downloadable support diagnostic for one connected company
Official Big Red Cloud help answers from Freshdesk articles, customer documentation, screenshots, and webinars — no company connection required
Local stdio and hosted HTTP transports

Security and safety model

Red is designed so that AI-driven access to accounting data stays controlled and auditable.

No credentials in the repository. Company connection credentials and secrets are never commit

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

86/100across 5 weighted dimensions

How we score →

0255075100

−14

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

8 fixed

CVE-2022-29244high · fixedCVSS 7.5

Packing does not respect root-level ignore files in workspaces

Affected: >= 7.9.0Fixed in 8.11.0source →

CVE-2018-7408high · fixedCVSS 7.8

Incorrect Permission Assignment for Critical Resource in NPM

Affected: >= 0Fixed in 5.7.1source →

CVE-2013-4116low · fixed

Local Privilege Escalation in npm

Affected: >= 0Fixed in 1.3.3source →

CVE-2020-15095medium · fixedCVSS 4.4

npm CLI exposing sensitive information through logs

Affected: >= 0Fixed in 6.14.6source →

CVE-2019-16777high · fixedCVSS 7.7

npm Vulnerable to Global node_modules Binary Overwrite

Affected: >= 0Fixed in 6.13.4source →

Inventory

Tools (12)

Click any tool to inspect its schema.

~379 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.BigRedCloud/red-mcp-server safe to use?: io.github.BigRedCloud/red-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install io.github.BigRedCloud/red-mcp-server?: io.github.BigRedCloud/red-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.BigRedCloud/red-mcp-server do?: io.github.BigRedCloud/red-mcp-server provides 12 tools: failedCompanies, ready, not_ready, Features, Architecture and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.BigRedCloud/red-mcp-server?: io.github.BigRedCloud/red-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.BigRedCloud/red-mcp-server actively maintained?: io.github.BigRedCloud/red-mcp-server is actively maintained — last commit was 4 days ago.

Similar servers

Others in finance

View all →

Alpha Vantage Mcp93

Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators

202 3

io.github.chrischall/honeybook-mcp92

HoneyBook client-portal MCP server for Claude — view contracts and invoices from wedding vendors

1 6

io.github.rustok-org/rustok-wallet92

Self-custody Ethereum agent wallet (MCP/stdio). Keys stay in a local Docker volume.

io.github.wyre-technology/qbo-mcp92

MCP server for QuickBooks Online — accounts, customers, invoices, bills, and reports.

2 11

MCP Security Weekly

Get CVE alerts and security updates for io.github.BigRedCloud/red-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?