io.github.blackwell-systems/knowing

The materials state that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication secrets are requested, so credential exposure appears low.

No remote endpoints or external service connections are declared in the known materials. There is currently no evidence that user data is sent out to third-party network destinations.

The system checks explicitly mark this tool as executes-code, indicating it may run code locally or invoke processes/system capabilities. This is a common high-privilege MCP capability and warrants caution, ideally in a constrained environment with review of the 22 exposed tool interfaces.

The description as a 'content-addressed code graph' reasonably suggests it processes local codebases or related file data. However, the materials do not specify read/write boundaries, directory scope, or whether it modifies files, so its local code/data access scope deserves caution.

Positive factors include an official registry source, an open-source repository, and updates within the last year. However, the lack of a README, no declared license, and very low community adoption (0 stars) mean there is limited audit context and ecosystem validation, so the source code and dependency list should be reviewed before deployment.