Brave Search

The materials explicitly state that no keys or environment variables are required. No API key, account token, or other highly sensitive credential is requested, so credential exposure appears low.

Although it lists no remote host, the stated 'web search' functionality typically implies that user queries may be sent to a search backend. The materials do not disclose concrete egress destinations, transmitted fields, or logging policy, so transparency is limited and this warrants caution.

The system checks indicate that this MCP tool executes code or runs a local process, which is a normal property of such tools. No evidence is provided of privilege escalation, persistence, or suspicious system actions beyond its stated purpose, so this is caution rather than high risk.

The description mentions 'local search,' which implies potential access to local data or indexing of local resources. However, the materials do not specify which directories can be read, whether indexes/caches are written, or what extra file permissions are needed. There is potential local data exposure, but no explicit over-privilege red flag is shown.

It comes from a curated source, has an official open-source repository that can be audited, and shows about 1.1k stars of community adoption—strong positive signals. While the license is not stated and maintenance status is unknown, the overall supply-chain risk appears low based on the available evidence.