io.github.CSOAI-ORG/stock-analyzer-ai-mcp

The material explicitly states that no secrets or environment variables are required. There is no request for API tokens, account credentials, or other sensitive authentication data, so credential exposure and abuse risk appears low.

No remote endpoint host is declared in the material, and there is no stated behavior of sending user data to external services. Based on the available facts, there is no explicit data-egress path; however, the lack of documentation means runtime verification is still advisable.

The system checks explicitly mark this tool as having executes-code capability, meaning it can run code or processes locally. This is a normal capability for such tools and not, by itself, a high-risk signal, but it should be used in a least-privilege and isolated environment.

The description only mentions stock analysis and ratio calculation, with no README or permission boundary details, so it is unclear what local files, caches, or other data resources it may access. There is no clear evidence of overbroad access, but the transparency of its data access scope is insufficient and should be monitored at runtime.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year; these materially reduce supply-chain risk. Caution remains because community adoption is currently 0 stars, the license is undeclared, and the README is missing, leaving project maturity and dependency governance less clear.