Olist Tiny ERP

The materials state that no keys or environment variables are required, and there is no indication that users must provide API tokens, account passwords, or other highly sensitive credentials, so credential exposure and abuse risk appears relatively low.

System checks confirm outbound access to api.mcp.ai; as an ERP-oriented MCP tool, user inputs and related business query content may be transmitted through that endpoint. No unknown third-party destination is evident, but outbound network transfer still warrants data-minimization caution.

System checks indicate that the tool executes code/spawns a process, which is standard for MCP tools. The available materials do not show requests for system privileges beyond its stated function, but it should still be treated as a locally executable component.

The description says it targets the official Olist Tiny ERP REST API v3 and covers business objects such as products and stock, indicating it may process e-commerce/ERP business data. There is no stated local file read/write or broad host data access, but the business data itself may be sensitive.

Positive factors include the official Registry source, an auditable open-source repository, and updates within the last year, which materially reduce supply-chain risk. Remaining cautions are the sparse README/documentation, no declared license, and 0 stars, meaning limited independent review and community validation.