mcp-server

The materials explicitly state that no keys or environment variables are required, and no API tokens, account passwords, or cloud credentials are declared. Based on the provided facts, there is no direct credential collection surface shown, though any router authentication method is undocumented.

Its stated purpose is router management and network control, which normally implies communication with routers or related network targets. Although no remote endpoint host is declared, the lack of documentation means the actual destinations, protocols, and any transmission of user input or device configuration data cannot be verified.

The system flags it as executes-code, meaning it can execute local code/processes. This is a standard high-privilege capability for MCP tools and warrants containment; the materials do not specify what system commands it may invoke or whether it can alter network settings or trigger device-management actions.

There is no README or permission description, so it is unclear what local files, configs, logs, or network-state data it can read or write. Given its network-control purpose, it may access device configuration and topology information, but there is no concrete evidence here of privileges exceeding its stated function.

A public open-source repository is a positive factor because it enables code review. However, it comes from a third-party registry, has no declared license, zero stars, unknown maintenance status, and no README, which weakens supply-chain maturity and verifiability. There is no explicit malicious red flag, so 'risk' is not justified, but source and dependency review is advisable.