io.github.Harusame64/desktop-touch-mcp

The listed environment variables appear to be local behavior/diagnostic settings (such as auto-guard, perception resources, idle timing, and log path), not API keys, tokens, or account credentials. No credential transmission to remote services is described, so credential abuse risk appears low.

No remote endpoints are declared in the provided facts, and there is no clear data-exfiltration path described. However, the mention of Chrome CDP implies interaction with a local browser debugging interface. There is currently no evidence that user data is sent to unknown internet endpoints.

The system marks this tool as executes-code, and the description includes type/click/scroll, UIA, Chrome CDP, and VBA, indicating strong local automation and possible script execution capability. These abilities can materially affect the desktop and applications, but for an MCP tool this is a normal high-privilege local capability; no evidence of stealthy or unrelated execution is provided.

Based on the description, it can take screenshots, read UI automation information, and write diagnostic logs via a configured log path, meaning it can access screen contents, UI text, and local log files. This access is consistent with its stated computer-use purpose, and there is no sign of requesting unrelated data privileges.

The source is an official registry entry and an open-source repository is provided, with updates within the last year; these are positive signals that reduce risk. Although community stars are low and no license is stated, the current materials do not show major red flags such as closed-source exfiltration, unknown origin, or obvious abandonment.