Codebase Memory

The materials explicitly state that no keys or environment variables are required. No API tokens, account credentials, or other sensitive secrets are requested, so credential exposure risk appears low.

The materials declare no remote endpoints, and there is no stated need to connect to external APIs or cloud services. Based on the available facts, no explicit user-data egress path is shown; however, because the README is missing, actual network behavior should still be verified in source.

The objective checks flag this tool as executes-code, indicating it can execute code locally or start related processing workflows. This is a common MCP capability and not a high-risk signal by itself, but it should be run under least-privilege conditions.

From the 'Codebase Memory / codebase knowledge graph' description, the tool likely needs to read local repository contents to build indexes or graph structures, potentially accessing source code, configs, and comments. There is no evidence of permissions beyond its stated purpose, but usage should be limited to necessary directories.

Positive signals include: official registry source, open-source availability, and updates within the last year, making the code auditable in principle. Points to watch are the missing README, undeclared license, and very low community adoption (0 stars), so transparency and ecosystem validation remain limited; source and dependency review is advisable before deployment.