io.github.PromptPartner/bexio-mcp-server

The materials explicitly state that no keys or environment variables are required, and no API key, token, or other explicit sensitive credential is requested. Since it claims to integrate with Bexio, you should still verify during installation whether any undocumented authentication method is used.

As a 'Swiss accounting integration for Bexio,' it likely needs to interact with an external accounting service, yet the materials also state 'remote endpoint host: none,' so the networking targets and egress scope are insufficiently disclosed. There is no explicit evidence of sending data to unrelated or unknown endpoints, but you should inspect the source for actual request destinations and uploaded fields.

The objective checks mark this tool as executes-code, meaning it runs code/processes locally as an MCP tool; this is a normal capability for this class of tool. The provided materials do not show requests for unusual system privileges or actions clearly unrelated to its stated purpose.

The description lists 314 tools related to invoices, contacts, projects, and account balances, indicating potential access to sensitive business/financial data. The materials do not specify exact read/write scope, whether destructive actions are supported, or whether data is cached locally, so this should be treated with the normal caution appropriate for sensitive business data access.

Positive factors include the official registry source, an auditable open-source repository, and updates within the last year, all of which materially lower supply-chain risk. Points to watch are the missing README, no declared license, and 0 stars, which weaken transparency and community validation, but these alone do not justify a high-risk rating.