Edgar

The materials explicitly state there are no required keys or environment variables, and describe the service as 'free, no auth'. No API token, account credential, or local secret is requested, so credential exposure risk appears low.

The tool accesses the remote endpoint gateway.pipeworx.io. The description says it is for SEC EDGAR public APIs, but the provided materials do not specify what fields are transmitted, whether user queries are proxied, or whether it only forwards public requests. This is standard network egress and should be limited to necessary query data sent only to the declared endpoint.

System checks indicate this MCP tool executes code / runs a local process, which is a common MCP tool behavior. The available materials do not show requests for unusual system privileges or high-risk actions unrelated to its stated purpose, so this remains a standard caution level.

The materials only indicate that it targets SEC EDGAR public APIs, with no stated need to read local files, write to disk, access databases, or request additional resource permissions. No data access beyond the stated function is evident.

The source is an official registry entry with an auditable open-source repository and updates within the last year, all of which materially reduce risk. While the license is not stated and community stars are low, there is currently no sign of closed-source distribution, abandonment, or suspicious packaging.