hive-mcp-compute

The materials explicitly state that no keys or environment variables are required. Based on the available information, there is no evidence that it asks for API keys, wallet private keys, or other sensitive credentials; however, its USDC/x402 payment description leaves some uncertainty because documentation is absent.

The description says it 'routes AI requests' and settles payments via Base L2/x402, which indicates the tool is likely designed to send user requests to model services and payment-related networks. Although no remote hosts are declared in the objective fields and no unrelated or obviously suspicious endpoints are identified, the actual recipients, scope, and whether prompt contents are transmitted are not transparent in the materials.

The system checks indicate this tool has code-execution capability, meaning it can execute code or related logic in the local environment. That inherent MCP/tool capability alone does not justify a high-risk rating, but the materials do not specify what system capabilities it can invoke, whether it spawns additional processes, or whether it executes external commands.

The materials do not declare explicit filesystem permissions or data directory scope, so there is no direct evidence of overbroad authorization; however, as a code-executing MCP tool, it may in practice access local input data and use AI request contents for external routing. Because the README is missing, the read/write boundaries for local files, caches, logs, or payment records cannot be confirmed.

A positive factor is that it is open source under the MIT license, so the code is in principle auditable, which materially lowers supply-chain risk. However, the source is only a third-party registry listing, the repository has 0 stars, maintenance status is unknown, and no README is provided here to verify functionality or dependencies, so trust remains limited and source/dependency review is advisable before use.