Frihet ERP

The material states that no keys or environment variables are required, and it does not request API tokens, database passwords, or cloud credentials, so the explicit credential exposure surface appears low. Business data itself may still contain sensitive fiscal or banking information.

It is known to connect to the remote endpoint mcp.frihet.io. Given the ERP, invoicing, tax, and banking functionality described, user business data is likely processed or relayed through that endpoint. Only the declared host is visible here, with no specific red flag of unknown exfiltration, but the actual payloads and retention policy should be verified.

System checks indicate that the tool executes code or starts a process, which is normal behavior for an MCP tool. The provided material does not show requests for unusual system privileges or clearly unrelated high-risk actions, so this is better classified as caution rather than risk.

Based on the description, the tool may handle invoices, tax, compliance, and banking-related business data, which is typically sensitive. The material does not specify which local files, databases, or system resources it can access, and no clear overbroad permission request is shown; however, the data scope should still be treated as sensitive.

The source is an official registry entry and provides an auditable open-source repository, with updates within the last year; these are positive factors that reduce risk. Although no license is declared and community stars are low, indicating modest ecosystem maturity, there is no clear supply-chain red flag from the available facts.