io.github.CSOAI-ORG/agent-x402-paywall-mcp

The material explicitly states that no keys or environment variables are required, and there is no indication that users must provide API keys, account passwords, or other highly sensitive local secrets; based on the available facts, the explicit credential exposure surface appears limited.

The tool connects to the remote endpoint api.meok.ai. Its description references an HTTP 402 protocol, on-chain settlement, and per-call payments, which implies that request content or transaction-related metadata may be sent to that service. The endpoint is known, but the lack of a README leaves egressed fields, minimization practices, and billing triggers insufficiently documented.

System checks indicate that this MCP executes code / runs a local process. That is a normal capability for this class of tool, and the provided material does not show requests for unusual system privileges or actions clearly unrelated to its stated function.

The material does not specify what local files, directories, or other resources it can read or write. As an MCP tool, it will at least handle invocation parameters and interaction data, but there is no evidence here of broad local data access beyond its stated purpose. Because documentation is sparse, the exact data boundary still warrants attention.

Positive signals include an official registry source, an open-source repository, and updates within the last year, all of which lower supply-chain risk. However, the repository has no declared license, very low community adoption (0 stars), and essentially no README, limiting audit context; a caution rating is therefore more appropriate than safe.