IBM watsonx.ai Granite

It requires WATSONX_API_KEY plus project, space, URL, model, and version environment variables. The API key and project/space identifiers are sensitive and could enable unauthorized use, resource abuse, or billing impact if exposed. No unusual credential grab is shown, but they should not be exposed in shared logs or client configs.

Although no fixed host is listed, the presence of WATSONX_URL indicates outbound requests to a user-configured watsonx service endpoint. Inputs for chat, text generation, and embeddings are likely sent to that remote service for processing. There is no evidence here of exfiltration to unrelated or unknown endpoints.

The system checks indicate this MCP tool executes code or starts local processes, which is a normal capability for this class of tool. The available material does not show requests for high-risk system privileges unrelated to its stated functionality, nor a suspicious execution chain.

The material only states chat, generation, embeddings, and tokenization capabilities, with no declared local filesystem write/read, database access, or broad resource enumeration permissions. Based on the current evidence, there is no clear sign of excessive data access, though it will still process user-submitted text.

Positive factors include an official registry listing, an open-source repository, and updates within the last year, all of which reduce supply-chain risk. However, the lack of a README, no declared license, and very low adoption (0 stars) limit auditability and ecosystem validation. Overall this fits caution rather than high risk.