io.github.CSOAI-ORG/mcp-spec-compliance-mcp

The materials explicitly state that no keys or environment variables are required. There is no indication that users must provide API tokens, account credentials, or other highly sensitive secrets, so credential exposure risk appears low.

It is known to contact the remote endpoint api.meok.ai. However, with no README, the materials do not explain what data is sent, whether the audited server.json content is uploaded, or what additional context may be transmitted. This creates ordinary network egress exposure, but there is no explicit red flag such as exfiltration to unrelated or multiple unknown endpoints.

System checks indicate that this MCP tool executes code or launches processes, which is a normal capability for this class of tool. The available materials do not show requests for unusual system privileges or clearly unrelated high-risk actions beyond auditing MCP configuration, so this is rated caution rather than risk.

Based on its stated purpose, it may need to read the target MCP server.json or related configuration files. However, the documentation does not specify whether it reads additional directories, writes results back, or retains data. The local data access boundary is not transparent, so least-privilege use is advisable.

Positive factors include an official registry source, open-source code, and updates within the last year. Cautions remain: the README is missing, the license is not declared, and community adoption is very low (0 stars), which limits auditability in practice and ecosystem validation; however, this alone is not enough to classify it as high risk.