io.github.Wolfe-Jam/claude-faf-mcp

The material states that no keys or environment variables are required. There is no evidence of requesting API tokens, account passwords, or other sensitive credentials, so credential exposure appears limited.

It is known to access the remote endpoint mcpaas.live. The description says it provides persistent project context, which implies project-related content may be sent to that service; however, the material does not specify data types, scope, encryption, or retention policy, so data egress boundaries require caution.

System checks indicate this tool has executes-code capability, meaning it can run code or processes locally. This is a common MCP capability; the current material does not show clearly excessive system permissions beyond its stated function, but it should still be run with least privilege.

Its function is to provide 'persistent project context,' which typically implies reading and storing some project data; however, with no README, it is unclear which files are read or written, whether access crosses project boundaries, and where the local/remote storage boundary lies. There is no explicit evidence of overreach, but the data scope is not transparent.

Positive factors include the official registry source, an open-source repository that can be audited, and updates within the last year. Points of caution are the missing README, no declared license, and very low community adoption (0 stars), which reduce external validation and maturity; however, the current evidence is insufficient to rate it as high risk.