peek

The materials explicitly state that no keys or environment variables are required. No API tokens, account passwords, or other sensitive credentials are requested, so credential leakage and abuse exposure appears low.

It declares no remote endpoints and describes itself as fully local. Based on the provided materials, there is no indication that user data is exfiltrated to third-party services or unknown hosts.

The system checks indicate executes-code capability, meaning the tool can start local processes or execute related code. This is a common but privileged MCP capability and should be run under restricted user permissions and in an isolated environment.

Its stated purpose is to expose recorded browser sessions to AI agents, including rrweb DOM, console, and network data. Even if processed locally, this may include sensitive page text, debug output, and request metadata, so recording scope and access should be tightly controlled.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year. However, the README is missing, the license is not declared, and community adoption is very low (0 stars), so auditability and maturity remain limited; a source and dependency review is advisable before use.