ai.snapdiff/mcp

It requires SNAPDIFF_API_KEY and SNAPDIFF_API_URL; the API key is sensitive and could be misused if exposed in logs, config files, or sessions. Based on the materials, these appear functionally required and there is no explicit red flag of credential theft or misuse.

No fixed remote host is listed, but the presence of SNAPDIFF_API_URL indicates a configurable network destination, and visual diff/change-detection data may be sent to that API. The materials do not specify recipients, scope, or retention, so data egress boundaries warrant caution.

The system flags it as executes-code, indicating it can run code locally or start related processing workflows. This is a common MCP capability, and the provided materials do not show system permissions clearly beyond its stated function, so caution is appropriate.

Its stated function—UI visual diff and change detection—typically implies access to screenshots, UI artifacts, or related project outputs. The materials do not specify exact read/write paths or persistence behavior, and there is no explicit evidence of overbroad access, so this is caution rather than high risk.

It comes from an official registry, has an auditable open-source repository, and was updated within the last year. Although the low star count and undeclared license reduce confidence in adoption and transparency, there are no high-risk red flags such as closed-source distribution, unclear provenance, or apparent abandonment, so supply-chain risk is relatively low.