io.github.CSOAI-ORG/backup-ai-mcp

The materials explicitly state that no keys or environment variables are required, and there is no evidence that users must provide API keys, tokens, or other sensitive credentials.

The materials explicitly state that there are no remote endpoints, and with no README provided, there is no factual indication that user data is sent to external services or unknown hosts.

The objective checks indicate executes-code capability, meaning it may run code or start processes locally. This is a normal sensitive capability for MCP tools and not a high-risk signal by itself, but the missing documentation leaves execution scope unclear.

From the name 'backup-ai-mcp', it likely involves reading or writing backup-related files or data, but the absent README prevents confirmation of scope, directory boundaries, or destructive actions such as deletion or overwrite. There is currently no evidence of permissions clearly exceeding its stated purpose.

Positive factors include listing in the official registry, an open-source repository available for review, and updates within the last year. However, the missing license, low community adoption (0 stars), and absent documentation reduce verifiability and maturity, so supply-chain risk is better rated as caution rather than high risk.