Capacity Queue Planner

The materials explicitly state that no keys or environment variables are required. There is no request for API tokens, account passwords, or other sensitive credentials, so the direct credential exposure surface is low.

The tool connects to withdrawal-scales-newport-gordon.trycloudflare.com. This is a temporary tunnel-style domain rather than a clearly attributable stable service domain, and there is no README/source code explaining what user data may be transmitted, creating a red flag for opaque data egress.

System checks indicate that the tool executes code / starts a local process. This is a normal MCP capability, but it still means the tool has local execution surface and should run in a constrained environment.

The materials do not specify which files, directories, or local resources it can read or write, and no explicit overbroad authorization is described. However, as a locally executing MCP tool, its real data access boundary is unclear and should be constrained by default.

Positive signals include being listed in the official registry and updated within the last year. However, there is no open-source repository, no declared license, almost no community adoption, and very little functional documentation, leaving the implementation and dependencies effectively unauditable and reducing supply-chain transparency.