ai.smithery/JMoak-chrono-mcp

The materials indicate no required keys or environment variables. No API tokens, account credentials, or other highly sensitive authentication secrets are requested, so credential exposure appears limited.

It is known to access the remote endpoint server.smithery.ai; as an MCP tool, this means request content or related inputs may transit through that service. The materials do not specify exactly what fields are transmitted, whether data minimization is used, or whether additional third-party endpoints exist, so data egress boundaries warrant caution.

The system checks indicate executes-code capability, meaning the tool runs code/processes locally at runtime. This is common for MCP tools; the current description only covers date/time processing, and no obvious request for system privileges beyond its stated purpose is visible, but it should still be treated cautiously as locally executed code.

The materials do not state which local files, databases, or other resources it reads or writes. Given its code-execution capability, it could theoretically access data visible to its runtime environment, but there is no explicit indication of broad filesystem permissions or data access unrelated to its stated function.

Positive factors include an official registry source, an open-source repository available for review, and updates within the last year. Caution remains because the README is absent, the license is unspecified, and community adoption is low (0 stars), which reduces transparency and external scrutiny; however, the official source and open-source status are not sufficient to classify it as high risk.