acrawl

The materials state that no API keys or environment variables are required. There is no indication that tokens, account credentials, or other sensitive authentication secrets are needed, so credential exposure risk appears low.

It is described as an 'Autonomous web crawler' with 17 browser tools. Although no fixed remote endpoint is declared, its functionality implies outbound requests to user-specified or agent-selected websites; this is a normal capability for such tools, but users should note that browsing/crawling may send data to destination sites.

The system checks explicitly include executes-code, and the tool is described as a 'Single binary,' indicating that it runs a local executable and drives browser/agent workflows. This is a normal high-privilege capability for MCP tools and should be sandboxed, but the materials do not show abnormal system permissions beyond its stated function.

As a browser automation/crawling tool, it will at minimum interact with visited web content and user-provided targets, prompts, or task parameters. The materials do not specify local file read/write scope, and there is no explicit sign of overbroad authorization. This currently looks like standard web-data access, though restricting its visible directories and runtime context is still advisable.

Positive signals include an official registry listing, an auditable open-source repository, and updates within the last year, all of which materially reduce supply-chain risk. Caution remains warranted because current community adoption is very low (0 stars) and no license is declared, indicating limited maturity/governance signals rather than a high-risk red flag.