mcp-server-demo

The materials explicitly state that no secrets or environment variables are required. No API tokens, account credentials, or sensitive local configuration are requested, so credential exposure and abuse risk appears low.

Although the metadata declares no remote endpoints, the weather-query feature commonly implies network requests. Because documentation is absent, it cannot be verified whether query content is sent to an external service, so outbound connections should be monitored at runtime.

The objective checks mark this tool as capable of code execution. This is a common inherent capability for MCP tools; the provided materials do not show requests for unusual system privileges beyond a calculation/query demo, but it should still be treated as locally executable code.

The description is limited to math expression calculation and weather querying. It does not declare any need to read local files, write to disk, access databases, or handle other sensitive data, and no signs of overbroad authorization are visible.

A public source repository improves auditability; however, it comes from a third-party registry, has no declared license, shows 0 stars, and has unknown maintenance status. Trust and maturity signals are weak, creating some supply-chain uncertainty.