Orshot

The material explicitly states that no keys or environment variables are required, and there is no indication that API tokens, account credentials, or local secrets must be provided; based on available facts, direct credential exposure appears low.

The tool connects to the remote endpoint mcp.orshot.com. Given its function of rendering images, PDFs, and videos from templates, user inputs or content to be rendered will likely be sent to that service for processing. The endpoint is relevant to the stated functionality, but this is still a clear data-egress scenario requiring care with sensitive content.

The system checks indicate executes-code capability, meaning the tool can start local processes or execute some code/commands. This is a common high-privilege capability for MCP tools; the available material does not show requests for system permissions clearly beyond its stated function, so this is a caution rather than a high-risk finding.

Based on the description, the tool handles brand assets, templates, folders, workflows, and generated images/PDFs/videos, which typically means it may access user-provided content and output files. The material does not specify which local paths it can read/write or whether sandboxing exists, so its data access should be treated with normal caution.

Positive factors include its presence in an official registry and updates within the last year. However, there is no open-source repository, no declared license, the source cannot be audited, and community adoption is very low (0 stars). Overall, the origin is not overtly suspicious, but auditability is limited and there is closed-source supply-chain opacity.