io.github.AceDataCloud/mcp-veo

It requires the sensitive credential ACEDATACLOUD_API_TOKEN. Such a token would typically authorize use of a remote video generation service, so leakage could enable quota consumption or account misuse. The materials do not show requests for unrelated or excessive secrets, so this is a normal caution-level concern.

It declares outbound connections to veo.mcp.acedata.cloud, and its function inherently implies sending prompts or generation requests to a remote service. Only a stated, function-related endpoint is visible here, with no evidence of exfiltration to unknown or unrelated domains.

The system flags this MCP tool as executes-code, meaning it runs a local service/process, which is a normal property of MCP tools. The available materials do not show requests for unusually broad system privileges or suspicious command execution unrelated to video generation.

No README or explicit data-access documentation is provided, so the exact local files or resources it may read/write cannot be confirmed. As an MCP service with execution capability, it should be treated with least-privilege assumptions for runtime inputs/outputs, but no explicit overbroad data-access red flag is shown in the materials.

Positive indicators include an official registry source, auditable open-source repository, and updates within the last year; these materially reduce supply-chain risk. Caution remains because the README is absent, no license is declared, and community adoption is very low (0 stars), which weakens external review and maturity signals, but not enough on its own to justify a high-risk rating.