GST Validator

The materials explicitly state that no keys or environment variables are required, and there is no request for account credentials, API tokens, or other sensitive authentication data, so credential exposure appears limited.

System checks show network access to gst-validator-mcp.atlasword.workers.dev. Although the description says 'validate locally,' there is an actual remote endpoint, which means user input may be sent to that service; the materials do not explain what is transmitted, logging practices, or whether it is only a proxy.

The system has identified that this MCP tool can execute code/start a process, which is a normal capability for such tools. The available materials do not show requests for unusual system privileges or high-risk actions unrelated to GST validation, but it should still be run with least privilege.

The description is limited to GSTIN validation, PAN extraction, and state identification, with no stated need to read/write local files, databases, or other sensitive resources; no excessive data permissions are evident from the materials.

Positive signals include the official registry listing, open-source repository, and updates within the last year, which reduce supply-chain risk. However, the repository has no declared license, very low community adoption (0 stars), and no README, leaving limited audit context and warranting verification of the actual implementation and dependencies.