io.github.CSOAI-ORG/translation-ai-mcp

The material explicitly states that no keys or environment variables are required. No API keys, tokens, or other sensitive credentials are declared, so credential exposure and abuse risk appears low.

The declared remote endpoints are 'none', and the available material does not state that text is sent to any external translation service. Based on the provided facts, there is no explicit data egress path, though the missing README means undocumented network behavior should still be verified in practice.

The system flags executes-code, indicating that the tool runs code or processes locally as part of MCP operation. This is a normal capability for such tools and not a high-risk sign by itself, but it should still be run with least privilege and appropriate isolation.

The material does not specify any file read/write scope, and it does not show requests for permissions beyond what its stated translation, language detection, and grammar-checking functions would need. Since it executes locally, it should still be assumed capable of accessing session inputs or host data that is explicitly granted, so directory and input scope should be constrained.

Positive signals include an official registry source, auditable open-source repository, and updates within the last year, all of which materially lower supply-chain risk. However, the missing README, undeclared license, and very low adoption (0 stars) limit transparency and external validation, so code and dependency review is recommended before use.