Nuvemshop

The material and install metadata indicate no required secrets or environment variables. There is no evidence that users must provide API tokens, passwords, or other sensitive credentials, so credential exposure risk appears low.

The tool is known to connect to the remote endpoint api.mcp.ai. Given its e-commerce functionality, user inputs and store data such as products, orders, customers, and categories may be transmitted through that endpoint. The material does not describe detailed data flows, encryption, or minimization controls, so data egress deserves attention.

System checks indicate that this MCP tool executes code or starts a local process. That is a normal property of MCP tools and is not, by itself, a high-risk signal. The available material does not show requests for unusual system privileges or actions clearly unrelated to its stated function.

By description, the tool can work with store products, orders, customers, and categories, which may involve business operational data and customer information. The material does not mention local file read/write access, and there is no clear sign of permissions beyond the e-commerce management use case, but least-privilege use is still recommended.

Positive signals include an official registry source, an auditable open-source repository, and updates within the last year, all of which materially reduce supply-chain risk. However, the missing README, unspecified license, and 0 GitHub stars limit transparency and community validation, so a caution rating is more appropriate than high risk.