io.github.AceDataCloud/mcp-flux-pro

It requires ACEDATACLOUD_API_TOKEN, which is a sensitive credential; if exposed through logs, config files, or child processes, it could be used to access AceDataCloud/Flux services. The materials do not show unusual overreach or credential misuse by design, but it should be handled as a production secret.

It is declared to connect to the remote endpoint flux.mcp.acedata.cloud; for Flux AI image generation, this typically means prompts and related request data are sent to AceDataCloud's cloud service. This egress destination matches the stated function, and no unrelated or unknown endpoints are shown.

The system checks indicate this tool has executes-code capability, meaning it can start local processes or run service code on the host. This is a standard capability for MCP tools, but the current materials lack a README and permission-boundary details, so the scope of system calls cannot be further verified.

The provided materials do not specify which local files, directories, or other resources it can read or write, so the data access scope is not transparent. As an MCP service with execution capability, it will at least process user-submitted data; however, there is no explicit sign of requesting excessive data permissions unrelated to image generation.

The source is an official registry entry, and there is a public open-source repository updated within the last year, all of which are positive trust signals that lower risk. Although the README is missing, the license is undeclared, and community stars are very low, these mainly affect usability and governance clarity and do not by themselves constitute a high-risk supply-chain red flag.