ai.inflowpay.app/inflow

The material states that no keys or environment variables are required, and no API token, account credential, or local secret is requested, so the credential exposure surface appears low. Still, if the real workflow involves payments or onboarding, verify at runtime whether it solicits account information interactively.

It is known to access app.inflowpay.ai, and the described functions—onboarding, payments, and service provisioning—imply that user input or business data may be sent to that declared endpoint. There is no evidence here of exfiltration to unknown or unrelated domains, but network egress itself warrants caution.

System checks indicate that this tool executes code/spawns processes, which is a normal capability for MCP tools and should be treated as caution. The material provides no README or finer-grained scope of system actions, so it cannot be confirmed whether it performs privileged operations beyond its stated purpose.

The current material does not clearly specify the scope of local file access, account data handling, or other resource access. Given that it is meant to let agents onboard, pay, and provision services, it may handle business data. No explicit overbroad authorization is shown, but the lack of documentation limits visibility.

The source is an official registry entry with a public source repository and updates within the last year, all of which are meaningful risk-reducing signals. While the community star count is low and the license is unspecified, indicating modest adoption and unclear licensing, these do not by themselves justify a high-risk rating in the absence of other red flags.