SEC EDGAR

The materials explicitly state that no keys or environment variables are required. There is no indication that API tokens, account passwords, or other sensitive credentials are needed, so credential exposure risk appears low.

The tool connects to the remote endpoint sec-edgar-mcp.atlasword.workers.dev to provide SEC data lookup functionality; this is normal for its stated purpose. The materials do not specify whether user queries or additional context are forwarded, so it should be treated as sending request data to that endpoint.

System checks indicate that this MCP tool executes code or starts a local tool process, but there is no evidence of it requesting high-privilege system capabilities unrelated to its purpose. Such local execution is a standard MCP characteristic, and the current materials show no specific red flag.

Based on the description, it primarily accesses SEC-related remote data resources. With no README, it is unclear whether it reads or writes local files, caches data, or accesses additional resources. Because the data access boundaries are under-documented, use should follow least-privilege principles.

Positive factors include being listed in an official registry, being open source, and having updates within the last year, which improve auditability and lower risk. Points to watch are the unspecified license, very low community adoption (0 stars), and missing documentation, which increase the cost of reviewing dependencies and implementation details.