google_maps_mcp

The materials explicitly state that no keys or environment variables are required, and no API key, OAuth token, or other sensitive credential is requested. Based on the provided information, direct credential-exposure risk is low, though the claimed functionality would normally rely on external map services, so the actual auth model should still be verified in source.

The description says it queries Google Maps and Places APIs through an MCP interface, which implies outbound network requests and that user search terms for places, businesses, or attractions may be transmitted to the relevant map service. The stated 'remote endpoint host: none' is not fully aligned with the functionality described, and the materials do not clearly list domains, request scope, or data-minimization behavior, so egress boundaries require attention.

The system checks indicate that this tool executes code, meaning it runs locally as an MCP component and handles calls on the host system. The provided materials do not show requests for unusual system privileges or actions unrelated to its stated purpose, so this is best classified as caution rather than high risk for a tool of this type.

The materials do not state any need to read or write local files, databases, browser contents, or other sensitive resources; the described functionality is limited to map and place queries. Based on the available information, there is no clear sign of excessive data-access scope, though the absence of a README means caching, logging, or local storage behavior should still be confirmed in the source.

The project is open source and MIT licensed, which are meaningful risk-reducing factors; however, it comes from a third-party registry, has 0 stars, unknown maintenance status, and lacks documentation, so its maturity and trust level remain limited. Overall, it looks like an auditable but not yet well-validated third-party component that should be source- and dependency-reviewed before production use.