MCPfinder - MCP Server Discovery

The materials explicitly state that no keys or environment variables are required, and there is no evidence that it asks for API tokens, account credentials, or other highly sensitive authentication data.

The description indicates it discovers and installs MCP servers across Official Registry, Glama, and Smithery, implying expected network access to those services. Although no fixed hosts are declared and there is no explicit statement of user data exfiltration, this kind of discovery/install workflow typically involves external queries and downloads, so the actual destinations and transmitted data should be reviewed.

The system flags it as executes-code, and 'installs MCP servers' implies it may run local installation steps or start components on the host. This is a common capability for MCP tools; the materials do not show abnormal privilege requests beyond the stated function, but execution should still be constrained.

Installing MCP servers typically requires reading configuration and writing to local installation locations or related files, so some local file access is reasonably implied. The materials do not specify exact read/write scope, and there is no evidence of data permissions clearly unrelated to its function.

Positive factors include: it comes from an official registry, is open-source, and has been updated within the last year, which improves auditability and source trust. However, the README is absent, the license is unspecified, community adoption is currently low (0 stars), and its core function involves discovering/installing third-party servers, which adds supply-chain exposure; reviewing the repository contents and actual install sources is advisable.