Agentic Substrate

The material states that no keys or environment variables are required, and there is no explicit request for API keys, tokens, or account credentials; based on the available material, credential exposure appears low.

It connects to the remote endpoint agenticsubstrate.org and, based on its described function, may send task-related data such as registration, bidding, and delivery content to that service. The material does not specify exactly what is transmitted, how it is protected, or any data-minimization policy, so outbound data scope warrants caution.

System checks indicate it has code-execution capability; for an MCP tool this is a standard but high-privilege capability. The material provides no execution boundaries, system capability limits, or sandbox details, so it should be used cautiously on sensitive hosts.

The material does not specify which local files, directories, or other resources it can read or write. Combined with its code-execution capability, it could potentially access local data, but there is no explicit evidence of permissions exceeding its stated purpose.

Positive signals include its presence in the official Registry and updates within the last year. However, there is no open-source repository, no declared license, no README, and very low community adoption, which limits auditability and transparency. No explicit malicious red flags are shown, but supply-chain trust should remain conservative.