io.github.patwalls/pulse-mcp

The materials explicitly state that no keys or environment variables are required, and there is no sign of credential collection, storage, or misuse; risk is low on this dimension.

No remote endpoints are declared, and the description does not state that data is sent to third-party services; based on the provided materials, no explicit egress path is evident.

The objective checks flag code execution capability, indicating it may spawn local processes or execute local code; this is a common MCP-tool capability, and the current materials do not show requests for high-risk system privileges beyond its stated function.

The README is absent, so the exact scope of readable/writable data cannot be confirmed from documentation; since it is an MCP tool with execution capability, local data access should be watched by default, but the materials do not show clear evidence of overbroad access.

The source is an official registry entry, with an auditable open-source repository and updates within the last year, all of which are strong positive signals; although community stars are low and the license is unspecified, these do not by themselves amount to a high-risk red flag.