Crankly

The materials state that no keys or environment variables are required, and there is no indication that API tokens, account passwords, or other sensitive credentials are needed, so credential exposure and abuse risk appears low.

Although no remote endpoint is declared, the description says it provides public vehicle data from StartMyCar, which implies possible outbound network access to fetch data; the materials do not clearly disclose actual hosts or egress boundaries, so runtime traffic should be monitored.

The objective checks explicitly mark it as executes-code, meaning it runs locally as an MCP service and executes code/processes. This is a normal capability for this type of tool, and the provided materials do not show suspicious system actions or privileges beyond its stated purpose.

The description only mentions providing structured public vehicle data and does not state any need to read user files, write local directories, access private databases, or use highly sensitive resources; based on the available materials, there is no sign of excessive data-access permissions.

A positive factor is that the source code is publicly available on GitHub and can be audited; however, it comes via a third-party registry, the repository has 0 stars, maintenance status is unknown, and no license is declared, so supply-chain maturity and maintenance confidence are limited.