tbro-mcp

The materials explicitly state that no keys or environment variables are required, and there is no indication of API tokens, account credentials, or other sensitive authentication data, so credential exposure and abuse risk appears low.

The tool provides web_search and web_fetch, which by design access external web resources and return results, representing normal network egress for this type of tool. Although no fixed remote endpoint is declared and there is no sign of unknown collection endpoints, user queries and target page requests would likely be sent outward.

The system checks indicate that it executes code, and the description shows it relies on the local tbro terminal browser, implying invocation of local programs or processes. This is a normal local execution capability for an MCP tool, and the provided materials do not show high-privilege actions beyond its stated purpose.

The description only states that it fetches webpage text and does not declare access to specific local files, databases, or system resources; however, as a locally running tool, its effective access still depends on the runtime account and host configuration. The materials do not prove overbroad access, but they also lack detailed permission boundaries.

The project is open source under the MIT License, and its source is auditable, which clearly lowers risk; however, it comes from a third-party registry, has 0 stars, and has unknown maintenance status, so public trust signals and ongoing maintenance evidence are weak, warranting caution from a supply-chain perspective.