io.github.DrBaher/contract-ops-mcp

The materials explicitly state that no keys or environment variables are required. There is no evidence of API tokens, account secrets, or other highly sensitive credentials being needed, so credential exposure risk appears low.

No remote endpoints are declared, and the description emphasizes “local-first CLIs,” with no clear sign of sending user data to external services. Because the README is absent, runtime network behavior should still be verified during deployment.

The objective checks mark this tool as executes-code, and its purpose is to expose nine CLIs as tools, which implies local command or process execution. This is a normal capability for MCP/CLI tools; no evidence shows excessive privileges beyond its stated function, but it should be run in an isolated environment.

As a local CLI aggregator for a “contract-ops suite,” it would typically interact with local contract or working-directory data, but the exact read/write scope is not documented here. There is no explicit sign of overbroad authorization, but it should be assumed to access local files and related resources that are granted to it.

Positive factors include the official registry listing, an open-source repository, and updates within the last year, which improve trust and auditability. However, 0 stars, no README, and no declared license reduce verifiability and maturity, so this is better classified as caution rather than high risk.