io.github.n24q02m/better-code-review-graph

The materials indicate it requires EMBEDDING_BACKEND, API_KEYS, LITELLM_PROXY_URL, and LITELLM_PROXY_KEY. API_KEYS and the proxy URL/key are clearly sensitive secrets; if pointed to a third-party proxy or logged improperly, they could be exposed or abused. However, there is no clear red flag showing malicious overreach in credential requests.

No fixed remote host is declared in the objective metadata, but the presence of LITELLM_PROXY_URL and an embedding backend implies it may send code-review-related data to user-configured model or proxy endpoints. With no README, the exact data egress, minimization behavior, and default destinations cannot be confirmed.

The system flags executes-code, meaning the tool can execute code or launch processes locally. This is a common MCP capability and not high risk by itself; however, without documentation, the exact system commands, subprocess scope, and isolation model remain unclear.

Based on the 'code review graph/knowledge graph' description, it likely needs to read local repository contents to build indexes or graphs, and may also create intermediate cache or embedding data. The materials do not show obvious overbroad access beyond the review use case, but the missing README leaves read/write scope and persistence locations unclear.

Positive factors include the official registry source, an auditable open-source repository, and updates within the last year; these all reduce supply-chain risk. Cautions remain because the license is not declared, GitHub adoption is currently very low (0 stars), and missing documentation makes dependencies and security boundaries harder to verify quickly, so source and dependency review is advisable before deployment.