Conveo

The materials indicate no required API keys or environment variables. There is no visible request for user API tokens, cloud credentials, or other highly sensitive secrets, so the explicit credential exposure surface appears limited.

The tool accesses app.conveo.ai, which is consistent with its stated role as a research platform. User research content, interview text, or analysis outputs may be transmitted to this official service for processing. The egress destination is declared, but it should still be treated as cloud data transfer.

The system checks indicate this tool has code-execution capability, meaning it may start local processes or run programs. This is a normal risk surface for MCP tools; the current materials do not specify the exact system capabilities exposed, so it is best run in a constrained environment.

The description covers study design, interview analysis, and insight generation, which typically involves user-provided or uploaded text data. The materials do not specify exact file read/write scope and show no clear overbroad authorization, but given the function, it should be assumed to potentially handle sensitive research material.

Positive signals include distribution via an official registry and updates within the last year. However, there is no open-source repository, no declared license, and low visible community adoption, which weakens external auditability. Overall, the source is not overtly suspicious, but the supply-chain transparency is limited, so caution is appropriate.