Artifact Delivery Planner

The materials explicitly state that no keys or environment variables are required. No API keys, account tokens, or other sensitive credentials are requested, so credential exposure and abuse risk appears low.

The tool connects to withdrawal-scales-newport-gordon.trycloudflare.com. This appears to be a Cloudflare temporary tunnel domain rather than a clearly attributable stable service domain. For a route-planning tool, user inputs are likely sent to that remote service, but the materials do not explain data scope, storage, or operator identity, creating a concrete transparency red flag for data egress.

System checks indicate that this tool executes code or starts processes locally. This is a common MCP capability, and the materials do not show it requesting obviously excessive system privileges beyond its stated function, so this warrants caution rather than a high-risk rating.

The available materials only say it is used to plan a delivery route and do not state that it reads or writes local files, databases, clipboard contents, or other sensitive resources. No obvious overbroad data permissions are described, though the sparse documentation leaves the real access boundary unclear.

Positive factors include its presence in the official registry and updates within the last year. However, there is no open-source repository, no declared license, and very low community adoption, so the code and dependencies cannot be independently audited, resulting in limited supply-chain transparency and a caution rating.