Almega

It requires ALMEGA_BACKEND and STRIPE_SECRET_KEY; the Stripe secret is highly sensitive, and if logged, forwarded, or misused by the tool, it could create payment-side abuse risk. The materials do not describe secret storage, least-privilege use, or isolation.

The materials list remote endpoint host as 'none', yet the tool requires ALMEGA_BACKEND, indicating that actual network destinations depend on external configuration and are not clearly disclosed here. There is no direct evidence of abnormal exfiltration, but data may be sent to the configured backend and should be verified.

System checks indicate that the tool can execute code or spawn processes. This is a common high-privilege capability for MCP tools, but the materials do not define execution boundaries, accessible system capabilities, or sandboxing, so it should be treated cautiously as local execution.

The available materials do not state that it can read or write specific local files, directories, databases, or cloud resources, and there is no obvious request for excessive data access. The scope is under-documented, but based on the known facts there is no clear overreach red flag in data access.

Positive factors include the official Registry source and updates within the last year; however, the source is not auditable, no license is declared, the README is absent, and community adoption is very low (0 stars), resulting in limited supply-chain transparency. Overall this fits caution rather than high risk.