io.github.CSOAI-ORG/meok-mcp-injection-scan-mcp

The material explicitly states that no keys or environment variables are required. There is no indication that API keys, account tokens, or other sensitive credentials are needed, so credential exposure and abuse risk appears low.

No remote host is declared, and the material does not state that user data is sent to any third-party service. Although the name mentions SSRF scanning, the current documentation does not show a clear outbound data path.

The objective checks mark this tool as executes-code, meaning it can run code or spawn processes locally. This is a common MCP capability and not a high-risk red flag by itself, but it should be run in a constrained environment and its actual system capabilities should be verified.

As a scanning-oriented MCP tool, it would typically need to read user-provided targets or local inputs to perform analysis. The current material does not specify exact read/write boundaries, and there is no explicit evidence of overbroad access. Because documentation is limited, the file access scope should be reviewed in source or package manifests before installation.

It comes from the official registry and has an auditable open-source repository with updates within the last year, all of which are meaningful risk-reducing signals. However, the missing README, unspecified license, and 0 stars reduce verifiability and maturity, so a caution rating is more appropriate than high risk.