io.github.CSOAI-ORG/agent-token-budget-mcp

The materials explicitly state that no keys or environment variables are required, and there is no sign that users must provide API keys, OAuth tokens, or other sensitive credentials; credential exposure appears relatively low.

The tool connects to the remote endpoint api.meok.ai, which means there is network egress; however, the materials do not explain what data is uploaded, what requests contain, or whether minimization is applied, so session content or budget-related data sent to that service should be reviewed.

System checks indicate that the tool has code-execution capability, meaning it runs locally as an MCP process and executes its implementation logic; this is typical for such tools, and the current materials do not show unusually dangerous system privileges or abnormal execution behavior.

The available materials do not declare access to specific local directories, databases, browsers, cloud drives, or other sensitive resources, nor do they indicate broad filesystem permissions; based on known facts, no obvious excessive data access is evident.

It comes from the official registry and has a public source repository updated within the last year, which are meaningful risk-reducing factors; however, the lack of a README, no declared license, and 0 community stars mean audit context and community validation remain limited, so source and dependency review is advisable before deployment.