io.911fund.x402/x402-alpha

The materials and system checks indicate no required keys or environment variables; no API key, wallet private key, or other highly sensitive credential is requested, so credential exposure appears low.

The tool connects to the remote endpoint x402.911fund.io, and the description says it uses 10+ live sources; user queries and related context will likely be processed by or forwarded through that service. The endpoint is declared, but the exact payloads and any onward sharing to other sources are not disclosed.

The system flags it as executes-code, meaning it runs tool code/processes locally; this is a normal MCP capability. The materials do not state any extra system privileges, and there is no evidence of execution behavior clearly exceeding what its query/intelligence function would normally require.

The README is absent and does not specify what local files, directories, or other resources it may read or write, so the data-access boundary is not transparent. At the same time, the available materials do not show it explicitly requesting broad disk, system-settings, or unrelated resource permissions.

Positive signals include distribution via an official registry and updates within the last year; however, there is no public source repository, no declared license, and near-zero community adoption, so the code and dependencies cannot be independently audited and supply-chain transparency is limited.