three.ws Avatars

The material only indicates an environment variable, THREEWS_BASE_URL; by name, it appears to be a service URL configuration rather than an access token or other sensitive credential. No API key, OAuth token, or account secret is mentioned, so direct credential leakage or abuse risk appears low, though internal service URLs should still not be exposed unnecessarily.

No fixed remote host is listed, but the tool clearly has outbound connectivity through THREEWS_BASE_URL, so the actual egress destination depends on deployment configuration. Because its function involves rendering or embedding a 3D avatar, it may send user input or session-related data to the configured service; this is a normal networked capability, and the BASE_URL should be restricted to trusted domains.

The system flags indicate that this tool executes code, meaning it runs local MCP process logic on the host. This is a standard capability for such tools, and the material does not show requests for unusual system privileges, arbitrary shell access, or privilege escalation, so caution is appropriate rather than high risk.

The description does not specify what files, directories, or data the tool can read or write, so its exact local data access scope cannot be confirmed from the material. As an executable MCP tool, it may in principle handle prompts, rendering parameters, or session data, but there is no evidence here of permissions exceeding its stated purpose.

The tool comes from an official registry, has a public source repository, and has been updated within the last year—all clear risk-reducing signals. Although the README is absent, the license is not declared, and community stars are minimal, which limits transparency and maturity assessment, the overall supply-chain risk remains relatively low due to the official source and open-source auditability.