Uber Conta by Digio MCP

The materials explicitly state that no extra keys or environment variables are required, and there is no indication that the user must provide an API key, long-lived token, or local sensitive credential; based on the known facts, credential exposure appears limited.

The tool connects to the remote endpoint api.mcp.ai, and its stated function involves financial information such as balances, statements, and card data, which implies relevant user data may be transmitted through that endpoint. No suspicious off-scope egress target is shown, but the transmitted content and server-side handling should still be reviewed.

System checks indicate that this MCP tool has code execution capability. For MCP tools, spawning local processes or executing logic is a standard capability; the available materials do not show requests for unusual system privileges or high-risk actions unrelated to its stated function.

From the description, the tool’s primary data access scope is financial account data related to Uber Conta by Digio, including balances, statements, and card information. This data is inherently sensitive, but the materials do not show additional access to unrelated local files or clearly excessive data scope.

The source is an official registry entry, with an auditable open-source repository and updates within the last year, all of which are clear risk-reducing signals. Although the repository does not declare a license and has very low star count, there are currently no high-risk red flags such as closed source, abandonment, or suspicious provenance.