io.github.lazyants/lexware

The materials state that no keys or environment variables are required; there is no explicit request for extra tokens, API keys, or local sensitive credentials. Note that, as an API-facing server, some authentication mechanism may still exist in practice, but the current materials do not disclose credential handling details.

The description says it is for the 'Lexware Office API', so it likely communicates with Lexware Office-related services and transmits business data such as invoices, contacts, articles, and vouchers. However, the metadata lists no remote endpoints, indicating incomplete disclosure of network egress; the actual domains and transmitted data should be verified before use.

The objective checks mark this tool as executes-code, meaning it can run a local service or code on the host. This is a normal MCP capability, and the provided materials do not show requests for excessive privileges or suspicious execution behavior beyond its stated function.

Its stated scope includes invoices, contacts, articles, and vouchers, which means it handles business financial and customer-related data. The materials do not describe local file read/write scope and do not indicate obvious overbroad access; however, because the data is sensitive, its effective data exposure should still be reviewed under least-privilege principles.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year; these substantially reduce supply-chain risk. Caution remains because community adoption is currently 0 stars, the license is undeclared, and the README is absent, leaving usability and compliance information incomplete; dependency and licensing status should be verified before deployment.