siftingio-mcp

The materials explicitly state that no keys or environment variables are required. No API token, account password, or other sensitive credential is requested, so credential exposure appears low based on the provided facts.

The description says it provides live prices, SEC filings, and economic calendar data, which typically requires network access to external sources. However, the materials also declare no remote endpoint, so the actual destinations are not transparent and should be verified for undisclosed outbound requests or query data transmission.

The objective checks indicate executes-code capability, meaning it can run code or processes locally. This is a common MCP-tool capability and not a high-risk signal by itself, but execution should be sandboxed and its actual system calls should be monitored.

A market-data tool typically should not need broad local file access, but the materials do not specify what local data, cache, or configuration paths it reads or writes. With no README details, local data access should be treated cautiously under a least-privilege approach.

The repository is open source and auditable under the MIT license, which are meaningful risk-reducing factors. However, it comes from a third-party registry, has 0 GitHub stars, and an unknown maintenance status, so supply-chain trust remains limited and the code and dependency pinning should be reviewed first.