mcp-notify

The description explicitly says it supports both bot and user tokens, while the metadata says there are no required credentials/environment variables; this is inconsistent. If it actually uses Slack tokens, they are sensitive credentials, and user tokens in particular carry higher abuse potential, so token sourcing, storage, and least-privilege scope should be verified.

Although no remote endpoint is listed in the metadata, the stated function is to send Slack messages, which normally implies outbound transmission of message content to Slack APIs. The materials do not specify domains, data scope, or whether any third-party relay is involved, so the actual network destinations and transmitted content should be checked.

The system flags it as executes-code, meaning it runs an MCP server or related code locally. For an MCP tool this is a normal capability, and the materials do not show any request for unusual system privileges or clearly unrelated high-risk operations beyond sending Slack messages.

The materials do not state which local files or data it reads or writes; by function it will at least handle outbound message content, and if token-based modes are supported it may also touch credentials. There is no explicit sign of overbroad access, but the data access scope is under-documented and should be confirmed in code, including any access to local config, logs, or message history.

Positive factors are that there is a public GitHub repository and an MIT open-source license, giving it auditability. However, it comes from a third-party registry, has 0 stars, and its maintenance status is unknown, so trust remains limited. There is no clear red flag such as opaque closed-source exfiltration, but the source and dependency locking should be reviewed before use.