io.github.Ninjabeam20/sportiq-mcp

The material explicitly states that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication data are requested, so credential exposure and misuse risk appears low.

No remote endpoints are declared, and the README does not describe network activity. Based on the available facts, there is no explicit data egress path or indication that user data is sent to third parties.

The system checks flag this tool as capable of code execution, meaning it may launch local processes or execute code as part of normal MCP behavior. This is a standard capability for such tools, but the documentation does not define execution boundaries or exposed system capabilities, so runtime permissions should be reviewed.

The available material does not specify what local files, caches, or user data it may read or write. As an executable MCP tool, it may theoretically access local resources, but there is no evidence here of excessive access beyond its stated purpose.

The source is an official registry entry, with a public open-source repository and updates within the last year, all of which materially reduce risk. However, the lack of a README, no declared license, and very low community adoption (0 stars) leave limited auditability, so supply-chain caution is still appropriate.