Claude FAF

The material explicitly states that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication data are requested, so credential exposure risk appears low.

The material lists no remote endpoint host, and the description only mentions persistent project context. There is no stated transfer of data to external services, so no explicit network egress path is evident from the provided facts.

The objective checks indicate an executes-code capability, meaning it may start local processes or execute code on the host. This is a standard MCP tool capability; the current material does not show unusually broad privileges beyond its stated purpose, but the execution environment should still be constrained.

The description, 'Persistent project context,' implies it likely reads and/or writes local project-related data or files to persist context. The material does not specify exact paths, scope, or isolation controls, so it should be treated with caution as a local project data access tool.

Positive signals include an official registry source, an auditable open-source repository, and updates within the past year; these materially reduce risk. Caution remains warranted because the README is absent, the license is undeclared, and community adoption is very low (0 stars), leaving limited evidence of maturity and audit depth.