openapi-mcp-bridge

The material explicitly states there are no required keys or environment variables; no API tokens, account credentials, or other sensitive secrets are requested in the provided material, so the credential exposure surface appears low.

Although no fixed remote endpoint is declared, its stated function is to turn OpenAPI definitions into tools callable by an LLM, which typically means making network requests to whatever APIs are described by the target OpenAPI spec; user inputs may therefore be sent to external services, but the actual destinations are not specified in the material.

The system checks indicate executes-code; as an MCP tool, it is expected to run a local bridge process and handle tool calls. This is a normal capability for this class of tool, and the material does not show system privileges beyond its stated purpose.

The description does not specify a clear data read/write scope; to parse OpenAPI definitions and expose MCP tools, it would typically at least read spec files or related inputs and process incoming request data. No broad filesystem permission request is shown, but the lack of documentation leaves the actual access boundary unclear.

There is an open-source repository, so the code is in principle auditable, which is a positive factor; however, the missing README, undeclared license, zero stars, unknown maintenance status, and third-party registry source create moderate supply-chain uncertainty. No concrete red flag is present that would by itself justify a high-risk rating.