io.github.chrischall/gogcli-mcp-classroom

The materials show it requires GOG_ACCOUNT and GOG_PATH. The former may relate to a Google account or authentication context, and the latter is a local path setting; there is the usual risk that leaked credentials or account configuration could be abused to access Classroom resources, but there is no evidence of requesting unusually sensitive secrets beyond its stated purpose.

No remote host is listed in the system checks, but the stated functionality involves Google Classroom, so interaction with relevant Google services is functionally likely. The materials do not disclose specific endpoints or data flows; there is no red flag of exfiltration to unknown or unrelated third parties, but network transparency is limited.

The system explicitly flags executes-code, indicating the tool runs code locally or spawns related processes. This is a common MCP-tool capability; the available materials do not show it requesting high-risk system privileges beyond what would be expected for a Classroom-related workflow.

Based on the description, the tool may handle course, assignment, submission, and grading data, and it requires GOG_PATH, implying access to local configuration or related data files. This access appears broadly consistent with its stated purpose, but the missing README prevents verification of least-privilege scope or whether it performs local writes/caching.

Positive factors include its presence in the official registry, an auditable open-source repository, and updates within the last year; these all reduce overall risk. Points to watch are the missing license declaration, very low community adoption (0 stars), and sparse public documentation, which limit maturity and auditability signals, but do not by themselves amount to a high-risk red flag.