Tendeta

The materials explicitly state that no keys or environment variables are required, and there is no evidence that API keys, tokens, or local secrets must be supplied. This suggests low direct credential exposure, although the actual authentication model may still rely on session or platform-managed auth that is not documented.

The tool connects to the remote endpoint mcp.tendeta.io, and its stated purpose—managing store catalog and orders—implies that relevant business data may be sent to Tendeta's service. The endpoint is aligned with the declared functionality rather than obviously unrelated, but the materials do not disclose data scope, encryption, retention, or minimization details.

The system checks indicate that this tool has code-execution capability, meaning it runs code or processes on the local side. For an MCP tool this is a normal capability and does not alone justify a high-risk rating, but the lack of README leaves the execution boundaries, accessible system capabilities, and command restrictions undocumented.

The description says it manages catalog and orders with 'store-scoped permissions,' indicating that the intended scope is primarily store-level business data rather than obviously unrelated system data. The caution comes from missing detail on which objects can be read or modified, whether order contents can be exported, and what local file access, if any, is involved.

On the positive side, it comes from the official registry, has been updated within the last year, and is marked as official-source/community-trust, all of which reduce source risk. However, there is no open-source repository, no declared license, and zero community stars, which limits external auditability, so the supply-chain dimension is best rated as caution.