io.github.CSOAI-ORG/agent-identity-trust-mcp

The materials state that no keys or environment variables are required. No API key, OAuth token, or local sensitive credential requirement is shown, so credential exposure appears limited.

The tool accesses the remote endpoint api.meok.ai, so there is a normal possibility that user input or context may be sent to that service. The materials do not describe what data is transmitted, minimization controls, or privacy boundaries, so data egress warrants caution.

The system checks indicate it has executes-code capability, meaning it runs a local service or related code on the host. This is a normal MCP characteristic, but due to missing documentation, the materials do not clarify whether it invokes any additional system capabilities.

There is no clear statement of what local files, directories, or other resources it can read or write. In an MCP setting, some local runtime and data handling is normal, but the materials are insufficient to show overbroad access or confirm least-privilege design.

It comes from an official registry, has an open-source repository, and was updated within the last year, all of which are positive signals. However, the README is missing, the license is undeclared, and community adoption is very low (0 stars), so auditability and maturity remain limited and the source and dependencies should be reviewed.