startup-valuationBLOCK
Comprehensive startup valuation library (80+ formulas) with an MCP server and AI-agent skills — scorecard, VC method, Black-Scholes, SaaS metrics, and more
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A comprehensive startup valuation library implementing 80+ formulas from the Startup Valuation textbook — Python library, MCP server, and AI-agent skills.
[](https://github.com/simonmak-ascent/startup-valuation/actions/workflows/ci.yml) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.simonmak-ascent/startup-valuation) [](https://glama.ai/mcp/servers/simonmak-ascent/startup-valuation) [](https://startup-valuation.simonmak.com/api) [](https://pypi.org/project/startup-valuation/) [](https://www.python.org/downloads/) [](https://github.com/simonmak-ascent/startup-valuation/actions/workflows/ci.yml) [](https://simonmak-ascent.github.io/startup-valuation/) [](https://scorecard.dev/viewer/?uri=github.com/simonmak-ascent/startup-valuation) [](https://opensource.org/licenses/MIT)
Overview
A production-grade Python library for startup valuation, implementing every formula from the [Startup Valuation](https://www.amazon.com/Startup-Valuation-Comprehensive-Fast-Growing-Pre-Revenue-ebook/dp/B0FYTGNVWS/) textbook by Simon Mak (Valuation in Practice Series, Ascent Partners
8f20e0d61b05OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add startup-valuation -- uvx startup-valuation==2.1.2 startup-valuation-mcp
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
exec( # noqa: S102 — names come from the static PROMPTS table above
mod = importlib.import_module(f"startup_valuation.{module_name}")method: Annotated[Literal['capm', 'startup_capm', 'portfolio_beta', 'wacc'], Field(description='Formula to apply. Options: capm = E(R) = Rf + β·(E(Rm) - Rf).; startup_capm = r = Rf + β·MRP + size prem
"summary": "βp = Σ wi·βi.",
.gitleaks.toml
.pre-commit-config.yaml
module = importlib.import_module(f"startup_valuation.{m['module']}")sudo mv mcp-publisher /usr/local/bin/
@auth/core, @sentry/nextjs, @vercel/analytics, bcryptjs, katex, next, pdf-lib, react
numpy, scipy
Gates applied: no_behavioural_pass.
8f20e0d61b05full audit observations/trust-audit/mcp-server/simonmak-ascent__startup-valuation.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 8f20e0d61b05 | BLOCK | D | 69 | first audit |
Questions
What is the startup-valuation MCP server?
Comprehensive startup valuation library (80+ formulas) with an MCP server and AI-agent skills — scorecard, VC method, Black-Scholes, SaaS metrics, and more
Is startup-valuation safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does startup-valuation need?
It reads AUTH_COOKIE_DOMAIN, AUTH_GITHUB_ID, AUTH_GITHUB_SECRET, AUTH_SECRET, DEEPSEEK_API_KEY, EODHD_API_KEY, NEXTAUTH_SECRET, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SURREALDB_PASS and SURREAL_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does startup-valuation run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as startup-valuation-platform at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (8f20e0d61b05), read on 2026-10-11. The repository is watched and re-audited when it changes.