TomeVault

The materials state that no keys or environment variables are required. No API tokens, account credentials, or other highly sensitive authentication secrets are requested, so credential exposure appears limited.

The tool connects to the declared remote endpoint mcp.tomevault.io. Its stated functions include searching, fetching, scanning, and converting AI instruction files, which typically implies that related input content or retrieval targets may be sent to that service; the materials do not specify finer-grained data flow or retention details.

The system checks indicate it has code-execution capability, meaning it may start local processes or execute code on the host. This is a common high-privilege capability for MCP tools; the provided materials do not show requests for extra system privileges clearly disproportionate to its stated function.

The description says it can search, fetch, scan, and convert AI instruction files, indicating it will at least access related files or content data. The materials do not describe readable/writable scope, directory boundaries, or whether data is persisted, so access should be limited to the minimum necessary scope.

Positive factors include distribution via an official registry and updates within the last year. However, there is no open-source repository or declared license, the source code cannot be audited, and community adoption is low (0 stars). Overall, supply-chain trust is moderate rather than high risk, but transparency is limited.