io.github.CSOAI-ORG/airspace-monitor-mcp

The materials explicitly state that no keys or environment variables are required. There is no evidence of access to API tokens, account credentials, or other sensitive local authentication material, so no clear credential abuse surface is identified.

The materials indicate no remote endpoints, and the README does not describe any external service connections. Based on the available facts, there is no evidence of user data being sent to third parties, though missing documentation means implementation-level networking cannot be fully ruled out.

System checks explicitly indicate this tool can execute code. For MCP tools, spawning local processes or executing code is a standard capability and does not by itself justify a high-risk rating; however, the absent README leaves the exact system capability boundaries unclear, so it should be run with least privilege.

The available materials do not specify which files, directories, or system resources are read or written, so no concrete over-privilege red flag is shown. Still, as an MCP tool capable of executing code, it may inherently interact with local data, and the lack of documented boundaries warrants sandboxing or a restricted working directory.

Positive signals include an official registry listing, an open-source repository, and updates within the last year, all of which materially lower supply-chain risk. However, the missing license, absent README, and very low community adoption (0 stars) limit auditability and maturity, making caution the most appropriate rating rather than safe or high risk.