voygent-mcp-app-demo

The materials explicitly state that no keys or environment variables are required, and there is no request for API tokens, account credentials, or other sensitive authentication data, so credential exposure appears low.

No remote endpoints are declared in the materials. The description only indicates an in-chat interactive pizza selection and submission demo; based on the available facts, there is no clear evidence of user data being sent to third-party services.

The objective checks flag this tool as executes-code, meaning it runs server code/processes locally. This is a normal capability for this type of tool and not by itself a high-risk sign, but execution should still be restricted and avoided in highly sensitive environments.

The provided materials do not specify which local files or resources it can read or write, so the exact data access boundary is unclear. As an executable MCP service, some local data access should be assumed by default, but no evidence is shown of permissions clearly excessive for a pizza demo.

Positive factors include being open source under the MIT license, making the code auditable. However, it comes from a third-party registry, has 0 GitHub stars, and has unknown maintenance status, which limits trust. No high-risk red flags such as closed source, spoofed origin, or obviously malicious claims are present, so caution is appropriate.