Pipedrive MCP

It requires PIPEDRIVE_API_KEY to access Pipedrive account data and perform CRUD operations; this is a sensitive business credential, and leakage could enable reading or modifying customer/deal data. The materials do not show extra credential harvesting or an obvious misuse pattern.

Although no remote host is listed in metadata, its stated functionality and required API key strongly imply communication with Pipedrive services and transmission of relevant business data to that intended platform. There is no clear red flag of sending data to unknown or unrelated third-party endpoints, but the sparse documentation leaves the exact egress scope unconfirmed.

System checks indicate this MCP executes code or launches a local process, which is a normal capability for this class of tool; the available materials do not show requests for system privileges beyond its integration purpose, nor suspicious command-injection behavior.

The description explicitly mentions a 'local SQLite pipeline copy,' indicating local storage of Pipedrive pipeline/deal-related data and support for full CRUD; this means it reads/writes business data and local database files. Based on the materials, there is no sign of broad access to unrelated local files, but sensitive customer data retention in the local copy should be considered.

The source is in an official registry and has an open-source repository, giving it reasonable auditability; it has been updated within the last year, and the system also marks community trust. Although the star count is low and no license is stated, these do not by themselves amount to high-risk red flags, so the overall supply-chain risk is relatively low.