CLIO Geojson

The materials explicitly state that no keys or environment variables are required, and there is no request for API tokens, account credentials, or other sensitive authentication data, so credential exposure and abuse risk appears low.

No remote endpoint is declared, and the description only covers local inspection, validation, and summarization of GeoJSON documents; based on the provided materials, there is no explicit data exfiltration path.

The system flags indicate that it executes code; as an MCP tool, this typically means starting a local service process and handling input data. There is no evidence here of unusual system privileges or actions unrelated to its stated purpose, but it should still be treated cautiously as a locally executable component.

Its stated functionality implies access to user-provided GeoJSON document contents for parsing and validation; this is routine data access for the tool’s purpose. The materials do not indicate reading unrelated local data beyond the input documents, nor do they show signs of overbroad authorization.

The source is an official registry entry, with a public source repository and updates within the last year; the 'stdlib only' claim also helps reduce dependency-chain complexity and improves auditability. While community stars are low and the license is undeclared, these are maturity concerns rather than standalone high-risk red flags.