io.github.shagarwal/databazaar

The materials explicitly state that no keys or environment variables are required, and there is no indication of API keys, OAuth tokens, or other sensitive credentials being requested; based on the available facts, credential exposure risk appears limited.

The tool accesses the remote endpoint api.databazaar.io, and its stated function of searching, purchasing, and selling datasets likely involves sending user queries or related data to that service; however, the materials do not show connections to unrelated or unknown third-party endpoints.

The system checks indicate an executes-code capability, meaning it can run code/processes locally as an MCP tool; the available materials do not show requests for system privileges clearly beyond its stated purpose, so this warrants caution rather than a clear high-risk rating.

The description only states that it interacts with a dataset marketplace and does not explicitly specify which local files or resources it can read or write; however, as an executable MCP tool, it may handle user input and dataset-related metadata, so least-data-exposure usage is advisable.

Positive evidence includes an official registry listing, an auditable open-source repository, and updates within the last year, which materially reduce supply-chain risk. Points to watch are the very low community adoption (0 stars) and the absence of a declared license, leaving maturity and compliance signals somewhat limited.