io.github.CSOAI-ORG/meok-omnibus-tracker-mcp

The materials explicitly state that no keys or environment variables are required. No API key, OAuth token, or other sensitive credential requirement is disclosed, so credential exposure appears limited.

No remote endpoint is declared in the materials, and the README is absent, so there is no explicit evidence of user data being sent to third-party services. However, due to sparse documentation, actual network behavior should still be verified in source.

The system flags executes-code, indicating that this MCP tool runs code/processes locally. This is a normal capability for this tool class; no unusual system privilege request is evident from the materials, but its actual launch command and callable capabilities should be reviewed.

The missing README does not clearly describe what local files, caches, or runtime data it may read or write. Given that it executes code as an MCP tool, some local data access is plausible by default, but there is currently no evidence of access clearly exceeding its stated purpose.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year. Points to watch are the minimal project documentation, undeclared license, and low community adoption (0 stars), which increase review difficulty but do not by themselves constitute a high-risk red flag.