io.github.shulex-voc/smart-crawler

The materials explicitly state that no keys or environment variables are required, and there is no indication that users must provide API keys, account passwords, or other sensitive credentials; based on the available information, credential exposure or misuse risk appears low.

It is known to access the remote endpoint smartcrawler.io. Its stated functions involve e-commerce competitor intelligence, VOC sentiment analysis, Amazon ASIN, and Reddit analysis, which commonly implies that relevant inputs or queries may be sent to that service; however, the materials do not show exfiltration to unrelated or unknown endpoints, so this is rated caution rather than risk.

System checks indicate that the tool executes code or starts local processes, which is a common capability for MCP tools. The available materials do not indicate any unusual system privilege requests or execution behavior clearly beyond its stated purpose, so this is a standard caution item.

The documentation does not specify what local files, directories, or data it can read or write, so transparency is limited. Given its analytics-oriented purpose and the fact that it executes code and uses the network, it should be assumed to process user-provided data or queries, but there is currently no evidence that it requests broad disk access or clearly excessive permissions.

The source is the official registry, and it has a public GitHub repository with updates within the last year, which are positive risk-reducing signals. However, the missing README, undeclared license, and very low community adoption (0 stars) limit auditability and maturity, so the supply-chain dimension is rated caution.