io.github.AceDataCloud/mcp-serp

It requires the sensitive credential ACEDATACLOUD_API_TOKEN to access its remote SERP service. If leaked, it could lead to quota abuse or unauthorized use of the service. The materials do not show requests for unrelated credentials, but the token should still be handled as a sensitive API secret.

It connects to the declared remote endpoint serp.mcp.acedata.cloud. Based on the stated functionality, user queries and related request data will likely be sent to that service to obtain search results. Only a function-related known endpoint is identified here, with no clear red flags of unrelated outbound connections.

The system checks indicate that this tool runs locally as an MCP service and has code execution/process-launch capability, which is a common runtime characteristic of MCP tools. The provided materials do not show requests for unusually high-risk system privileges unrelated to search functionality.

The provided materials do not specify what local files or additional data resources it may read or write, so the scope of local data access is not transparent. Given its search-proxy role, it should at least be assumed to process user input and transmit it remotely. No explicit overbroad access is described, but the lack of documentation reduces verifiability.

There are several positive supply-chain signals: official registry listing, auditable open-source repository, and updates within the past year, with system flags for official-source/open-source/community-trust. Although GitHub stars are low and the license is unspecified and README is absent, these are governance gaps rather than concrete high-risk supply-chain red flags.