io.github.CSOAI-ORG/agent-audit-logger-mcp

The materials explicitly state that no keys or environment variables are required. There is no indication that users must provide API keys, OAuth tokens, or other sensitive local credentials, so the credential exposure surface appears limited based on the available facts.

It is known to connect to the remote endpoint api.meok.ai, and its stated function is audit logging, so it is reasonable to infer that tool-call or A2A interaction logs may be sent to that service. Connecting to a declared endpoint is a normal capability, but the exact egressed fields should be verified for prompts, parameters, outputs, or other sensitive context.

The system checks indicate that this tool has code-execution capability, meaning the MCP service/code runs locally. This is a standard property of MCP tools, and the current materials do not show requests for unusual system privileges or clearly unrelated high-risk actions, so this is a caution rather than a risk.

As an 'audit logger,' it is likely designed to access tool-call, agent handoff, and related metadata; however, the README is absent, so the materials do not confirm exactly which local files, caches, or session contents it reads or writes. There is no clear evidence of overbroad authorization, but the data access scope is not transparent enough and should be verified in the implementation.

Positive factors include the official registry listing, an open-source repository, and updates within the last year, all of which reduce supply-chain risk. However, the materials do not declare a license, the README is missing, and community adoption is 0 stars, which limits transparency around intended use and dependencies. Overall the source is relatively trustworthy, but the code and dependency list should still be reviewed first.