Autotask

The materials show it requires AUTOTASK_USERNAME, AUTOTASK_SECRET, AUTOTASK_INTEGRATION_CODE, AUTOTASK_API_URL and related settings. The username/secret/integration code are sensitive API credentials; if exposed, they could be used to access or act on Autotask PSA business data. AUTH_MODE, MCP_TRANSPORT, and LOG_LEVEL are less sensitive by themselves.

Although no fixed remote host is listed, AUTOTASK_API_URL indicates the tool will connect to a user-configured Autotask API endpoint and may transmit business data such as tickets, companies, projects, and time entries. This is consistent with its stated function, and the materials do not show data being sent to unrelated or unknown third-party endpoints.

The system checks indicate this MCP tool executes code / runs a local service process, which is a common capability for this type of tool. The available materials do not indicate unusual system privileges, unrelated command execution, or obvious local control beyond what an Autotask integration would normally require.

By description, it can access business objects in Autotask PSA such as companies, tickets, projects, and time entries, which may include operational and customer service records. The materials do not state that it additionally reads/writes local files or requests data permissions unrelated to this integration, and no clear over-authorization is evident.

It is distributed via an official registry and has a public source repository with updates within the last year, providing reasonable auditability and some maintenance signal. While the GitHub star count is low and the license is undeclared, creating some adoption and compliance uncertainty, the supply-chain posture is overall lower risk due to the official source and open-source availability.