io.github.AceDataCloud/mcp-suno

It requires the sensitive credential ACEDATACLOUD_API_TOKEN to access the remote Suno-related service; if exposed, it could allow third parties to consume account quota or access related service functions, but the materials do not show explicit credential theft or misuse behavior.

It is declared to connect to the remote endpoint suno.mcp.acedata.cloud; given its music generation, lyrics, and cover features, user prompts, generation requests, and related content will likely be sent to that service. This is normal egress for a remote AI tool, and no unrelated or unknown extra exfiltration endpoints are shown in the materials.

System checks indicate it executes code/runs an MCP server process, which is a common operating model for MCP tools. The available materials do not show requests for system privileges beyond its stated function, nor suspicious command execution or persistence behavior.

The provided materials do not specify what local files, directories, or other resources it can read or write, so the local data access boundary is not fully transparent; however, there is also no evidence that it asks for excessive data permissions unrelated to music generation.

The source is an official registry entry and it has a public open-source repository with updates within the last year, which are positive trust signals that lower risk. Although community stars are low and the license is unspecified, that affects adoption and compliance clarity more than security and does not by itself constitute a high-risk supply-chain red flag.