uspto-patents-mcp

The material explicitly states there are no required keys or environment variables. No API tokens, account credentials, or other sensitive secrets are requested, so credential exposure and abuse risk appears low.

The description mentions patent search, full-text retrieval, citation graphs, and weekly alerts, which commonly rely on external patent data sources; however, the material also declares no remote endpoints. This leaves a visibility gap, and it is currently unclear whether queries or user data are sent to any sites, so actual network behavior should be monitored.

The system checks confirm executes-code, meaning it runs code/processes locally. This is a normal MCP capability, and the material does not show requests for system privileges clearly beyond its stated purpose, so this is rated caution rather than high risk.

The documentation does not specify which local files, cache directories, or persistence locations it reads or writes. Given its search and alert features, it may use local result caching or configuration storage, but no explicit overbroad access is described. Because the data access scope is opaque, caution is warranted.

A positive factor is that an open-source repository exists, so the code is in principle auditable. However, it comes from a third-party registry, has no declared license, zero stars, unknown maintenance status, and lacks a README, which reduces auditability context. There are no concrete red flags strong enough for a high-risk rating, but supply-chain confidence is limited.