Rede Celcoin MCP

The materials state that no separate API key or environment variables are required, which reduces developer-secret exposure. However, the stated function is to connect a Rede Celcoin/Open Finance account, so real use will likely involve user authorization credentials or session tokens, which are sensitive if misused.

It is known to access the declared remote endpoint api.mcp.ai. Given its account-query functionality, user requests and results related to balances, statements, cards, or investments will likely traverse that endpoint. There is no evidence here of exfiltration to undeclared or unrelated domains.

System checks indicate that it executes code / runs a local MCP tool process, which is a normal property of this tool class. The materials do not show requests for system privileges beyond its stated function, nor any suspicious execution chain.

The description indicates access to Rede Celcoin/Open Finance account data such as balances, statements, cards, and investments, which is highly sensitive financial information. Based on the available materials, this access is aligned with the stated function, and there is no indication of extra local file access or obvious over-privileging.

Positive factors include: official registry origin, an auditable open-source repository, and updates within the last year; these materially reduce supply-chain risk. Points to watch are the missing README, no declared license, and 0 community stars, which leave limited audit context and community validation.