io.github.avabuildsdata/mcp-us-business-data

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  unscannable15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No source files, package manifest, or tool schemas were fetched; cannot assess credential handling.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  pass10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  tool surface, capabilities, install scripts, and publisher unchanged vs prior version 1.9.235 (patch bump); no rug-pull drift.

• Transport config

  pass10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/us-sec-edgar-filings-search,pink_comic/sam-gov-federal-contracts-search,pink_comic/irs-990-nonprofit-search" uses TLS (https); remote endpoint "https://autoscrape-api-seven.vercel.app/mcp" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/yellowpages-scraper,pink_comic/building-permits-and-contractor-leads" uses TLS (https); remote endpoint "https://autoscrape-api-seven.vercel.app/mcp/sse" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/texas-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/yellowpages-scraper,pink_comic/building-permits-construction-leads" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-api-contractor-leads,pink_comic/ca-contractor-license-search-cslb-lookup" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellowpages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/secretary-of-state-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/us-secretary-of-state-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellow-pages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/yellow-pages-scraper,pink_comic/us-business-entity-search,pink_comic/building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper,pink_comic/building-permits-search,pink_comic/fl-sunbiz-business-search,pink_comic/ca-sos-business-search,pink_comic/tx-sos-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellowpages-leads-scraper,pink_comic/building-permits-construction-leads,pink_comic/ca-contractor-license-lookup" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/texas-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellow-pages-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-leads-scraper,pink_comic/building-permits-construction-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellowpages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/yellowpages-scraper,pink_comic/us-business-entity-search,pink_comic/building-permits-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper,pink_comic/building-permits-search,pink_comic/ca-contractor-license-search,pink_comic/florida-business-search,pink_comic/texas-sos-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper,pink_comic/building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search-multi-state,pink_comic/yellow-pages-search,pink_comic/building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper,pink_comic/us-building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellowpages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search-sos" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellowpages-scraper,pink_comic/building-permits-construction-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-secretary-of-state-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?actors=pink_comic/us-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellowpages-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/texas-business-leads,pink_comic/california-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellowpages-scraper,pink_comic/florida-sunbiz-search,pink_comic/texas-sos-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-scraper,pink_comic/yellow-pages-scraper,pink_comic/email-validation-checker,pink_comic/phone-validation-checker,pink_comic/ca-contractor-license-search,pink_comic/npi-registry-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permit-leads,pink_comic/yellowpages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-secretary-of-state-business-entity-search,pink_comic/building-permits-contractor-leads,pink_comic/florida-sunbiz-business-search,pink_comic/texas-business-search-sosdirect,pink_comic/ca-contractor-license-search-cslb" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellowpages-scraper,pink_comic/us-sos-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellowpages-scraper,pink_comic/building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/us-building-permits-search,pink_comic/yellowpages-scraper,pink_comic/us-secretary-of-state-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/yellow-pages-scraper,pink_comic/building-permits-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellow-pages-leads-scraper,pink_comic/ca-contractor-license-cslb-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellow-pages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/us-building-permits-search,pink_comic/yellowpages-scraper,pink_comic/us-email-address-search,pink_comic/us-phone-number-lookup" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/cslb-contractor-license-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/yellow-pages-scraper,pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/email-validation-checker,pink_comic/florida-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellow-pages-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/us-building-permits-search,pink_comic/us-secretary-of-state-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/us-building-permits-search,pink_comic/us-secretary-of-state-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/california-business-leads,pink_comic/texas-business-leads,pink_comic/sunbiz-florida-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/secretary-of-state-search,pink_comic/florida-business-search,pink_comic/texas-business-search,pink_comic/california-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/fl-sunbiz-business-search,pink_comic/tx-sos-business-search,pink_comic/nj-sos-business-search,pink_comic/yellowpages-business-leads-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/secretary-of-state-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/california-business-leads,pink_comic/texas-business-leads,pink_comic/secretary-of-state-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-secretary-of-state-business-entity-search,pink_comic/building-permits-contractor-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-scraper,pink_comic/florida-business-search,pink_comic/california-business-search,pink_comic/texas-business-filing-search,pink_comic/new-york-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search-from-secretary-of-state,pink_comic/building-permits-construction-leads,pink_comic/yellowpages-leads-scraper,pink_comic/email-address-scraper" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/sec-edgar-company-filings,pink_comic/irs-990-nonprofit-search,pink_comic/whois-domain-lookup,pink_comic/yahoo-finance-stock-chart" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/email-validation,pink_comic/phone-validation" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-api,pink_comic/fl-business-entity-search,pink_comic/ca-business-entity-search,pink_comic/tx-business-entity-search,pink_comic/ny-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/professional-license-lookup,pink_comic/california-business-leads,pink_comic/texas-business-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/new-york-business-leads,pink_comic/new-jersey-business-leads,pink_comic/cslb-contractor-license-search,pink_comic/nppes-npi-registry" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-api,pink_comic/ca-contractor-license-search,pink_comic/florida-business-search,pink_comic/texas-business-entity-search,pink_comic/ca-business-entity-search,pink_comic/new-york-business-entity-search,pink_comic/ohio-business-entity-search,pink_comic/illinois-business-entity-search,pink_comic/georgia-business-entity-search,pink_comic/pennsylvania-business-entity-search,pink_comic/michigan-business-entity-search,pink_comic/north-carolina-business-entity-search,pink_comic/virginia-business-entity-search,pink_comic/washington-business-entity-search,pink_comic/colorado-business-entity-search,pink_comic/minnesota-business-entity-search,pink_comic/indiana-business-entity-search,pink_comic/arizona-business-entity-search,pink_comic/missouri-business-entity-search,pink_comic/arkansas-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/sec-edgar-company-search,pink_comic/us-building-permits-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/california-business-leads,pink_comic/texas-sos-business-search,pink_comic/new-york-business-entity-search,pink_comic/illinois-business-entity-search,pink_comic/ohio-business-entity-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/texas-business-leads,pink_comic/california-business-leads,pink_comic/new-york-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/sse?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/yellow-pages-scraper,pink_comic/ca-contractor-license-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/california-business-leads,pink_comic/texas-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/california-business-leads,pink_comic/texas-business-leads,pink_comic/sunbiz-florida-business-leads,pink_comic/new-york-business-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/us-secretary-of-state-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/fl-sunbiz-business-search,pink_comic/ca-sos-business-entity-search,pink_comic/tx-sos-business-entity-search,pink_comic/ny-dos-corporation-llc-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-api,pink_comic/fl-business-search,pink_comic/ca-business-search,pink_comic/tx-business-search,pink_comic/ny-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-api,pink_comic/florida-sunbiz-business-search,pink_comic/california-sos-business-search,pink_comic/texas-sos-business-search,pink_comic/new-york-business-search,pink_comic/illinois-sos-business-search" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-search,pink_comic/yellowpages-scraper,pink_comic/email-finder,pink_comic/phone-number-lookup" uses TLS (https); remote endpoint "https://mcp.apify.com/mcp?tools=pink_comic/us-business-entity-search-secretary-of-state" uses TLS (https); remote endpoint "https://mcp.apify.com?tools=pink_comic/us-business-entity-search,pink_comic/building-permits-construction-leads,pink_comic/whois-domain-lookup" uses TLS (https); remote endpoint uses OAuth (strongest auth mode)