kpi-dealflow-mcp

The material explicitly states there are no keys or environment variables required, and no API tokens, account passwords, or other sensitive credentials are mentioned; based on the available material, credential exposure appears low.

The description says it adds, lists, gets, and updates leads through KPI DealFlow, which functionally suggests interaction with an external service; however, the material also lists no remote endpoints, and with no README or network details, actual data egress and recipients cannot be verified, so the lack of transparency warrants caution.

The system flags this tool as executes-code, meaning it can execute code or processes locally. This is a common MCP-tool capability and does not by itself justify a high-risk rating, but it should still be run in a constrained environment and its actual execution scope should be reviewed.

From the functional description, it can add, retrieve, and update real-estate leads, implying access to business contact and pipeline data. The material does not specify which local files, caches, or persistence locations are read or written, nor does it define least-privilege boundaries, so the data-access scope lacks transparency.

A positive factor is that an open-source repository exists, enabling code review; however, the source is only a third-party registry, the license is undeclared, the README is missing, it has 0 stars, and maintenance status is unknown, so community and governance signals are weak and supply-chain trust is limited.