Shelly Smart Home

The materials explicitly state that no keys or environment variables are required, and there is no indication of API tokens, account passwords, or other sensitive credentials, so credential exposure and abuse risk appears low.

Although no remote host is declared and the tool is described as local-first, its functionality requires communicating with Shelly smart-home devices, which typically implies LAN network access. There is no evidence of data being sent to third-party cloud services, but device-side network interaction should still be assumed.

The system flags indicate that this tool executes code or runs a local process, which is a standard MCP capability and warrants normal caution. The provided materials do not show requests for unrelated elevated system permissions, nor obvious signs of malicious execution behavior.

Based on the description, its primary data scope appears to be Shelly device status, energy, and automation control data rather than broad local file access. The materials do not specify local file or database read/write behavior, so no clear excessive data access is evident, but device control and state access still warrant caution.

The tool is listed in an official registry, has public source code, and was updated within the last year—clear factors that reduce risk. However, the repository has no declared license, community adoption is very low (0 stars), and the lack of a README limits audit context, so supply-chain trust is best rated as cautious rather than high risk.