MCP Office PowerPoint

The listed variables (PPT_ALLOWLIST_ROOTS, PPT_ENABLE_WRITE, PPT_ENABLE_COM) appear to be local configuration flags/path restrictions rather than API keys or account secrets; no external service credentials are evidenced, so credential leakage/abuse risk appears low.

The remote endpoint field is listed as none, and the description only mentions building, editing, and exporting .pptx files, with no evidence of sending user data to external services. Based on the provided materials, network egress risk appears low.

The system flags indicate code execution; for an MCP tool, this typically means running a local service process. Combined with PPT_ENABLE_COM and the 'Windows-first' description, it may invoke local PowerPoint/COM automation, which warrants caution as local execution capability, but no evidence shows system permissions beyond the stated purpose.

Its functionality requires handling and exporting PowerPoint files, and the presence of PPT_ALLOWLIST_ROOTS and PPT_ENABLE_WRITE suggests it may read files within allowed roots and write/export when enabled. Local file access is a normal capability for this class of tool, and the current materials do not show red flags of excessive data access.

Positive signals include an official registry source, an open-source repository, and updates within the last year, all of which materially reduce risk. However, the lack of a README, no declared license, and 0 stars mean limited transparency and community validation, so a caution rating is more appropriate than risk for supply chain.