OpenDART MCP Server

The materials explicitly state that no keys or environment variables are required. There is no indication that API tokens, account passwords, or other sensitive credentials must be supplied, so credential exposure risk appears low.

Although the 'remote endpoint' field says none, the description clearly states that it accesses the Korean Financial Supervisory Service's OpenDART API, so it should be treated as having outbound access to an official service relevant to its stated purpose. There is no evidence here of exfiltration to unknown or unrelated third-party endpoints.

The objective checks mark this tool as executes-code, meaning it runs a local service process/code; this is a normal MCP capability. The materials do not show requests for unusual system privileges or dangerous actions unrelated to its stated function.

The materials do not specify which local files or directories it reads or writes, so the visible data-access scope is limited but unclear. As an MCP service, it would at least process user queries and returned corporate disclosure data, but there is no evidence of broad disk access, system configuration changes, or obvious over-privileging.

The project has a public GitHub repository and an MIT open-source license, making the source auditable; these are positive factors that reduce risk. However, it comes from a third-party registry, has only 0 stars, and its maintenance status is unknown, so the supply-chain trust signals are weak and the code and dependencies should be reviewed before deployment.