Semanticscholar

The material indicates no required keys or environment variables. There is no stated need for API tokens, account credentials, or other highly sensitive secrets, so credential exposure risk appears low.

The tool connects to the declared endpoint gateway.pipeworx.io, which means network egress occurs. Because the README is absent, the exact payloads and whether user queries are forwarded cannot be confirmed from the material, but only the stated relevant endpoint is shown and there is no evidence of exfiltration to unknown or unrelated destinations.

System checks indicate it has executes-code capability, meaning it runs locally as an MCP tool/process. This is standard for this class of tools; the provided material does not show requests for unusual system privileges or clearly unrelated high-risk operations.

The available material does not specify what local files, directories, or other resources it can read or write, so the data access scope is not transparent. No explicit overbroad access is stated, but with no README, it should be treated with least-privilege controls.

It comes from an official registry and has a public source repository with updates within the last year, making it auditable and relatively trustworthy. Although community stars are low and the license is not declared, this reduces maturity and compliance clarity rather than constituting a high-risk red flag by itself.