com.qmailing/mcp-server

It requires the sensitive credential QMAILING_API_TOKEN; if exposed, it could be used to read/send email and manage mailboxes, domains, and webhooks, affecting business communications and configuration. No abnormal overreach is shown in the materials, but the token should be treated as a high-value API secret with least privilege.

It declares outbound connections to qmailing.com, and its functionality implies that email content, mailbox settings, domain data, or webhook-related information may be sent to the QMailing API. This is an expected endpoint for the stated service, with no red flag of exfiltration to unknown or unrelated destinations.

The system indicates code execution/process spawning, which is common for MCP tools. The available materials do not show requests for system privileges beyond what an API integration would typically need, nor suspicious command-execution behavior, but it should still run in a constrained environment.

Per its description, it can access email, mailboxes, domains, and webhooks—resources with high sensitivity but aligned with its stated purpose. The materials do not indicate broad local file access or access to unrelated resources, so there is no clear sign of excessive authorization.

It comes from an official registry and has an auditable open-source repository with updates within the last year, which are strong positive trust signals. Although the README is absent, the license is unspecified, and community stars are very low, these are more governance/usability uncertainties than high-risk supply-chain red flags based on the current facts.