Cloudflare Deployer

The material explicitly states there are no required keys or environment variables, and it does not indicate any need for API tokens, account passwords, or other sensitive credentials. Based on the provided facts, there is no clear credential collection or misuse red flag.

The description says it can deploy apps to Cloudflare, so it likely performs network communication with Cloudflare-related services as part of its function. However, no specific endpoints are listed, and the provided checks show no remote endpoint inventory, leaving the egress scope and transmitted data unclear and in need of verification.

The system explicitly flags executes-code, indicating this MCP tool can initiate local execution or deployment actions. That is a normal capability for this class of tool, but the exact commands and any additional system capabilities are not disclosed in the material.

It claims to deploy full-stack applications involving databases, authentication, and file storage, which typically implies reading project files and possibly writing build, deployment, or configuration artifacts. The material does not define file scope or permission boundaries, so its accessible working directories should be constrained and checked for access beyond deployment needs.

A positive factor is that it is open source and theoretically auditable. However, it comes from a third-party registry, the repository has no README, no declared license, 0 stars, and unknown maintenance status, which limits practical trust and auditability. There is no concrete malicious red flag strong enough for a high-risk rating, but the source code and dependencies should be reviewed before use.