io.github.CSOAI-ORG/ascii-art-ai-mcp

The material explicitly states that no secrets or environment variables are required, and no API tokens, account credentials, or other sensitive secrets are requested; based on the available information, credential leakage or abuse risk is low.

The material explicitly lists no remote host endpoints, and there is no indication that it must connect to external services or send user data to third parties; based on current evidence, network egress risk is low.

The system check indicates executes-code, meaning it runs code/processes locally as an MCP tool; this is a normal capability for such tools and does not by itself justify a high-risk rating, but it should still be installed in a controlled environment with limited invocation scope.

The README is absent and does not specify what local files, directories, or resources it can read or write, so the data access boundary is not fully transparent; there is no explicit over-privilege red flag, but it should be run with least privilege.

Positive signals include the official registry source, an open-source repository, and updates within the last year, all of which materially lower supply-chain risk; however, the license is unspecified, the README is empty, and community adoption is very low (0 stars), so auditability and maturity remain only moderate and warrant some caution.