mcp-crypto

The materials explicitly state that no keys or environment variables are required, and no API tokens, account credentials, or other sensitive authentication inputs are described; based on the available materials, credential leakage or misuse exposure appears low.

The described functionality involves obtaining cryptocurrency market data and exchange rates, which typically depends on external data sources; however, the materials do not disclose specific remote endpoints, so the egress destination and data scope lack transparency and should be verified against function-related market data services in the actual implementation.

The objective checks mark this as executable code, meaning the MCP tool runs program logic locally; this is an inherent property of such tools. The materials do not show requests for system privileges beyond the stated functionality, nor obvious signs of malicious execution behavior.

The materials do not specify which local files, databases, or other resources may be read or written, so the data access scope is not fully transparent; there is no current evidence of overbroad access, but the source should be checked for filesystem and runtime permission use.

Positive signals include open-source availability and an MIT license, which make code review possible; however, it comes from a third-party registry, the GitHub repository shows 0 stars, and maintenance status is unknown, so trust and maturity evidence are limited. This creates some supply-chain uncertainty, but not enough on its own to classify it as high risk.