.FAF Context

The material explicitly states that no keys or environment variables are required, and it does not request API tokens, account credentials, or other sensitive authentication data, so credential exposure and abuse risk appears low.

No remote endpoints are declared, and there is no README content indicating that project content or user data is sent to external services. Based on the available facts, no clear network egress path is identified.

The system flags this tool with executes-code, indicating it has the ability to start processes or execute code locally. This is a common capability for MCP tools, but it still warrants caution around permission boundaries and runtime context.

The description says it provides 'Persistent project context,' which reasonably implies reading and possibly writing local project-related context data; however, the material does not specify directories, file scope, or whether content is modified, so its actual access boundaries should be treated with caution.

Positive signals include an official registry source, an auditable open-source repository, and updates within the past year, all of which materially reduce supply-chain risk. Still, the missing README, undeclared license, and very low community adoption (0 stars) limit transparency and maturity, so caution is appropriate.