io.github.YawLabs/mcp-compliance

The materials explicitly state that no keys or environment variables are required, and there is no indication that users must provide API tokens, account passwords, or other sensitive credentials, so credential exposure appears low.

No remote endpoints are declared, and the materials do not state that user data is sent to external services; based on the available information, there is no explicit outbound data path.

The system checks explicitly mark executes-code, and as a CLI/MCP server, the tool will run locally and execute its testing logic. This is a normal capability for this class of tools, but it should be run in a controlled environment.

As a local CLI/MCP tool, it will typically interact with user-specified MCP server configurations, test inputs, or local runtime information; the materials do not define precise read/write boundaries, so it should be used with least privilege, but there is no clear red flag of excessive access beyond its stated purpose.

Positive factors include distribution through the official registry and updates within the past year; however, there is no open-source repository, no declared license, and very low community adoption (0 stars), making independent review of source and dependencies difficult. Overall this is a supply-chain caution, not high risk based on closed source alone.