io.github.CSOAI-ORG/unit-converter-ai-mcp

The materials explicitly state that no keys or environment variables are required, and no API tokens, account credentials, or other sensitive authentication needs are described, so credential exposure and abuse risk appears low.

The materials declare no remote endpoints, and the description does not indicate network calls, data uploads, or reliance on third-party services; based on available facts, there is no evidence of user data being sent externally.

The objective checks mark this tool as executes-code, meaning it runs locally as an MCP service and executes code. This is a normal property of such tools; the current materials do not show requests for unusual system privileges beyond unit-conversion functionality, but it should still be run with least privilege.

The third-party materials do not specify any need to read or write particular files, directories, databases, or other local resources; however, as a locally run MCP tool, it may inherit the baseline access of its host process. There is no explicit evidence of overbroad access, but the lack of detail warrants attention.

Positive factors include listing in an official registry, an auditable open-source repository, and updates within the past year; these materially reduce supply-chain risk. Points to watch are the missing README, unspecified license, and very low community adoption (0 stars), which limit maturity and review confidence, but are not by themselves enough to justify a high-risk rating.