TradeOS Public Intelligence

It requires multiple sensitive environment variables: TRADEOS_PUBLIC_INTEL_KEY, TRADEOS_ACCOUNT_TOKEN, plus x402 payment/agent/wallet-related identifiers and headers. If exposed, they could enable account access, paid routing abuse, or misuse of market intelligence APIs. The materials do not describe least-privilege scoping, storage, or rotation practices.

No fixed remote host is listed, but the configurable bases TRADEOS_API_BASE and TRADEOS_X402_BASE_URL indicate outbound requests to external services. Given the 'market intelligence' and 'paid x402 SKU routing' description, user queries and related metadata may be sent to the configured TradeOS/x402 endpoints. The materials do not provide concrete domains, data-flow details, or privacy disclosures.

The system checks indicate that this tool executes code/spawns processes, which is a common MCP capability. The available materials do not show requests for unusual system privileges or actions unrelated to its stated purpose, so this warrants standard caution around isolation and least privilege rather than a high-risk rating.

The materials only state market intelligence, evidence, watchlists, and feedback features, without specifying which local files, directories, or other resources are read or written. It is reasonable to expect handling of user input and possibly account/watchlist data, but there is no evidence of data-access requests beyond the stated functionality. The missing README leaves the exact scope unclear.

It is listed in an official registry and has a public source repository with updates within the last year, all of which are positive indicators that reduce risk. Although the license is unspecified and community stars are 0, indicating limited ecosystem maturity, there are no clear supply-chain red flags based on current auditability and source trust.