com.energyaisolution/energyai

The materials state that no keys or environment variables are required, and there is no indication that users must provide API keys, OAuth tokens, or local sensitive credentials, so credential exposure appears limited. However, “x402 per call” suggests some form of per-call billing, and the exact payment or authorization mechanism is not disclosed.

The tool connects to the declared endpoint api.energyaisolution.com. Based on the stated functionality, user inputs related to energy node scoring, solar/heat-pump/battery advice, incentives, or quote review are likely sent to the service for processing; this is normal network egress, but the materials do not describe data minimization, retention, or privacy boundaries.

System checks indicate that the tool executes code or starts processes, which is a normal capability for MCP tools and therefore warrants caution regarding local execution surface. The materials do not disclose what system commands it can invoke, whether sandboxing exists, or what permission boundaries apply, but there is no explicit evidence of privilege requests clearly unrelated to its stated function.

The provided materials do not specify which local files, directories, or other resources it can read or write, so the data access scope is opaque. Since it executes code, it could theoretically touch local data, but there is no factual indication here that it requests clearly excessive access beyond what an energy-advice workflow would need.

Positive factors include its presence in an official registry and updates within the last year, which reduce supply-chain risk. However, the source is not auditable, no license is declared, and community adoption is at 0 stars, which weakens verifiability and independent review. Overall this indicates moderate supply-chain uncertainty rather than a clear high-risk case.