copilot-status-mcp

The material explicitly states that no keys or environment variables are required, and there is no stated need for API keys, tokens, or other sensitive credentials; based on the provided material, the explicit credential exposure surface is small.

Although no remote endpoint is declared, the stated function—checking GitHub Copilot quota, rate limits, and reset times—normally implies interaction with GitHub/Copilot-related services. The material does not list specific domains, request scope, or whether any extra context is transmitted, so the actual outbound targets and payloads should be verified in source.

The system checks mark this tool as executes-code, meaning it runs and executes code locally as an MCP server. This is a normal capability for this class of tool; the provided material does not show requests for unusual system privileges or actions clearly unrelated to its stated purpose.

The provided description and README do not state any need to read or write local files, databases, the clipboard, or other sensitive resources, nor do they show a broad data access requirement. Based on the current material, there is no clear sign of overbroad access, though the source should still be checked before deployment.

Positive factors include a public GitHub repository that is auditable and MIT-licensed, which lowers supply-chain risk. However, it comes from a third-party registry, has only 0 stars, and has unknown maintenance status, so maturity and sustained maintenance signals are weak and dependency/update quality should be reviewed.