io.github.CSOAI-ORG/agent-cost-allocator-mcp

The material explicitly states that no keys or environment variables are required, and there is no indication that users must provide API keys, OAuth tokens, or other sensitive credentials; based on the available facts, credential exposure appears limited.

It is known to access the remote endpoint api.meok.ai, so there is a network egress path; however, the material does not specify what data is sent, for what purpose, or under what minimization controls, so caution is warranted regarding possible transmission of cost-attribution-related inputs or metadata.

The system checks indicate it has code-execution capability, meaning it will run an MCP service or related code locally. This is a common characteristic of such tools, but the missing documentation prevents further confirmation of whether it invokes additional system capabilities.

The third-party description and README are nearly empty and do not clearly state which local files, directories, or other resources it can read or write, so the data access scope cannot be fully verified. There is no explicit red flag of over-privilege, but the lack of transparency calls for cautious deployment under least-privilege assumptions.

Positive factors include the official registry source, an open-source repository, and updates within the past year; these meaningfully reduce supply-chain risk. Points to watch are the missing README, no declared license, and low visible community adoption (0 stars), which leave auditability and maturity evidence somewhat limited.