Petstore MCP Server

The materials explicitly state that no keys or environment variables are required, and there is no request for API tokens, account passwords, or other sensitive secrets, so credential exposure and abuse risk appears low.

The tool is declared to access the remote endpoint petstore.run.mcp.com.ai for Swagger Petstore API testing/prototyping. Network egress is a normal capability for this type of MCP; the available materials do not show additional outbound destinations or any red flags such as unrelated or unknown endpoints.

System checks indicate that this tool executes code / runs a local service process, which is a standard operating pattern for MCP tools. The materials do not indicate requests for system privileges beyond API proxy/testing purposes, and no obviously suspicious execution instructions are present.

The current description does not provide a README or a clear data-access inventory, so it is not possible to confirm whether it reads/writes local files, caches request data, or accesses other host resources. Given its MCP runtime nature, it is reasonable to assume limited data handling related to sessions/API interactions, but there is no evidence of clearly excessive authorization requests.

The source is an official registry entry and an open-source repository is provided, enabling code audit; there is some community adoption (8 stars) and updates within the past year, both of which are positive risk-reducing signals. The missing license declaration and absent README reduce transparency, but are not sufficient on their own to make this high risk.