Frappe Assistant CoreBLOCK
Infrastructure that connects LLMs to ERPNext. Frappe Assistant Core works with the Model Context Protocol (MCP) to expose ERPNext functionality to any compatible Language Model
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Talk to your ERPNext site. FAC lets Claude, ChatGPT, and other MCP-ready LLMs work directly with your invoices, customers, stock, workflows, and custom apps — inside your ERPNext permissions, with every call logged.
[](https://github.com/buildswithpaul/FrappeAssistantCore/releases) [](https://pypi.org/project/frappe-assistant-core) [](LICENSE) [](https://modelcontextprotocol.io) [](https://docs.assistantcore.cloud/api/tool-reference) [](https://docs.assistantcore.cloud)
[](https://github.com/buildswithpaul/FrappeAssistantCore/actions/workflows/ci.yml) [](https://cloud.frappe.io/marketplace/apps/frappeassistantcore) [](https://github.com/buildswithpaul/FrappeAssistantCore/stargazers) [](https://github.com/buildswithpaul/FrappeAssistantCore/network/members) [](https://github.com/sponsors/buildswithpaul)
New in FAC 3.0: FAC Chat
FAC 3.0 introduces FAC Chat — an opt-in, in-Frappe AI chat assistant powered by FAC Cloud, our managed service. What it does, what it costs and how to sign up: ****.
FAC now offers two ways to use it:
- **BYO-LLM (MCP ser
262c0f89d197OBSERVED · 2026-10-05Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add frappe_assistant_core --env FRAPPE_API_KEY=${FRAPPE_API_KEY} --env FRAPPE_API_SECRET=${FRAPPE_API_SECRET} -- npx -y frappe_assistant_core{
"mcpServers": {
"frappe_assistant_core": {
"command": "npx",
"args": [
"-y",
"frappe_assistant_core"
],
"env": {
"FRAPPE_API_KEY": "${FRAPPE_API_KEY}",
"FRAPPE_API_SECRET": "${FRAPPE_API_SECRET}"
}
}
}
}Exposed tools (5)
2 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_task | write | Create a task in the default project. |
delete | destructive | Delete a document |
search | read | Find |
search_tasks | read | Full-text search across every task you can see. |
send | write | Send a message |
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
# IMPORTANT: Always include patch('frappe.log_error') in all test methods to prevent MagicMock pickling errorsmodule = __import__(app_name)
__import__(dep)
module = importlib.import_module(module_path)
__import__(dep)
mod = __import__(pkg)
delete
.pre-commit-config.yaml
.releaserc
.semgrepignore
new Function(readFileSync(`${WIDGET_DIR}/widget_routing.js`, "utf8"))();new Function(readFileSync(`${WIDGET_DIR}/widget_streaming.js`, "utf8"))();new Function(readFileSync(WIDGET_SRC, "utf8"))();
new Function(source).call(globalThis);
return new Function("attached_files", `${body}\nreturn attachments;`)(attachedFiles);return f"curated_{hashlib.sha1(text.encode()).hexdigest()[:8]}"digest = hashlib.sha1()
"../../views/ChatView.vue",
"../../views/SettingsView.vue",
"../../views/AnalyticsView.vue",
"../../views/KnowledgeBase.vue",
"../../views/WorkflowList.vue",
decoded = base64.b64decode(encoded).decode("utf-8")content = b64.b64decode(file_data)
content = base64.b64decode(file_data)
Gates applied: no_behavioural_pass.
262c0f89d197full audit observations/trust-audit/mcp-server/buildswithpaul__frappe-assistant-core.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-05 | 262c0f89d197 | BLOCK | F | 57 | first audit |
Questions
What is the Frappe Assistant Core MCP server?
Infrastructure that connects LLMs to ERPNext. Frappe Assistant Core works with the Model Context Protocol (MCP) to expose ERPNext functionality to any compatible Language Model
What tools does Frappe Assistant Core expose?
5 in total: 2 read-only, 2 that write, and 1 that can delete or overwrite (delete). Every one is listed on this page with its risk.
Is Frappe Assistant Core safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Frappe Assistant Core need?
It reads FRAPPE_API_KEY and FRAPPE_API_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Frappe Assistant Core run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as frappe_assistant_core.
How current is this page?
The grade is for one exact copy of the source (262c0f89d197), read on 2026-10-05. The repository is watched and re-audited when it changes.