ShotAPI MCP Server

The materials indicate no API keys, tokens, or environment variables are required, and there is no direct sign of credential collection, storage, or abuse.

The tool is declared to connect to the remote endpoint aiphotoshop.mynatapp.cc; given its 'Screenshot and HTML render' functionality, user-supplied HTML, URLs, or rendered content may be sent there for processing. The domain is a natapp tunnel domain rather than a typical stable primary domain, so while there is no direct evidence of malice, this should be treated as a notable data-egress consideration.

System checks indicate that it executes code; for a screenshot/HTML-rendering MCP, this typically means starting local rendering or helper processes. The provided materials do not show requests for system privileges beyond its stated function, so this is rated as a normal caution-level local execution capability.

Based on the description, the tool will at least handle target pages, HTML content, and generated image outputs; this means it may process user-supplied data and produce files or binary results. The materials do not show evidence of broad arbitrary local file access or unrelated resource access, but sensitive page content should still be minimized.

Positive factors include: it comes from the official registry, is open-source, and has been updated within the last year, so the code is in principle auditable. Points to watch are the missing license declaration, very low GitHub adoption (0 stars), and sparse public documentation, which reduce external review and maturity signals; therefore the supply-chain posture is caution rather than high risk.