io.github.AceDataCloud/mcp-producer

It requires ACEDATACLOUD_API_TOKEN, which is a sensitive credential. The materials do not show unusual overreach or explicit credential abuse, but it should still be stored with least privilege and kept out of logs, synced configs, and shared environments.

It is declared to connect to producer.mcp.acedata.cloud, which aligns with its stated music-generation service. This likely means prompts or related inputs may be sent to the remote endpoint, but the materials do not show exfiltration to unrelated or unknown third parties.

As an MCP tool marked as executes-code, it will run its implementation as a local server/process. The provided materials do not indicate suspicious execution chains or requests for system privileges beyond its stated purpose.

The available materials do not specify what local files or data it reads or writes, so persistence or broad directory access cannot be confirmed. Given normal MCP tool behavior, it is prudent to assume it may handle session inputs and local configuration.

It comes from an official registry entry and has an auditable open-source repository with updates within the last year, all of which are meaningful risk-reducing signals. Although it has low star count and no declared license here, its supply-chain transparency is still better than closed-source or untrusted-origin tools.