QI SCD MCP

The materials explicitly state that no keys or environment variables are required, and there is no indication that users must provide a local API key, token, or long-lived credential. However, given its account-connection function, some external account authorization flow may still exist in practice, though the details are not disclosed.

It is known to connect to the remote endpoint api.mcp.ai. Based on the description about connecting a QI SCD account and querying balances, statements, cards, and investments, user queries and related financial data will likely be transmitted through that endpoint; this is expected network egress but involves sensitive financial information.

The system checks indicate that this tool executes code or starts a local process, which is a standard MCP capability. The available materials do not show requests for system privileges beyond its stated function, nor any suspicious commands or privilege-escalation signs.

Its stated function focuses on accessing balances, statements, cards, and investment information in an Open Finance context, which is highly sensitive data. The materials do not indicate local file read/write access, but remote financial data access itself should be used under least privilege and minimal query scope.

The source is the official registry, with a public GitHub repository and updates within the past year, all of which are positive factors that reduce risk. However, the lack of a README, no declared license, and low community stars mean auditability and community validation remain limited, so reviewing the source and dependencies before enabling it is advisable.