io.github.Wolfe-Jam/gemini-faf-mcp

The material explicitly states that no keys or environment variables are required, and there is no indication of API tokens, account credentials, or other sensitive authentication data being requested, so credential exposure and abuse risk appears low.

The material lists no remote endpoints, and the description does not claim any need to connect to external services; based on the available facts, there is no evidence of user data being sent to third-party network endpoints.

The system flags executes-code, and as a Python/FastMCP tool it has the normal capability to run code/processes locally. This inherent capability alone does not justify a high-risk rating, but it should be treated as a caution-level local execution surface.

Its stated purpose is 'persistent project context,' which reasonably implies local reading and/or writing of project-related context data/files; the available material does not show obvious overreach, but persistence and project data access are caution-worthy by nature.

Positive signals include listing in an official registry, open-source availability, and updates within the last year, all of which reduce overall risk; however, the README is effectively absent, the license is unspecified, and community adoption is very low (0 stars), so the supply-chain dimension is better rated as caution rather than risk.