MCP Gateway Scan

The materials explicitly state that no keys or environment variables are required, and there is no indication that API tokens, account credentials, or other sensitive authentication secrets are needed, so credential exposure and misuse risk appears low.

No remote endpoints are declared, and the description only indicates a read-only repository scan; based on the available materials, there is no factual indication of user data being sent to third-party services.

The system checks mark it as executes-code, indicating the ability to run code/processes locally; this is a common MCP tool capability, and the current materials do not show requests for system privileges beyond its stated purpose, but it should still be run in a controlled environment.

The description says it is a read-only scanner, implying it at least needs to read repository contents to produce scores; the current materials do not show evidence of writing, local persistence, or access to unrelated data, so no obvious over-privilege is visible, though repository read access still merits user attention to scan scope.

It comes from an official registry, has a public open-source repository, and was updated within the last year, all of which are positive risk-reducing signals. Although the star count is low and the license is not declared, which adds some adoption and compliance uncertainty, the auditable source code and official source are not enough to justify a high-risk rating.