Clarity MCP Server

The description says it extracts and calls web APIs from HAR files; HARs commonly contain cookies, Authorization headers, or session tokens. Even though the tool itself requires no environment secrets, directly reusing captured auth material from HARs creates a clear credential leakage or misuse risk.

Its stated purpose is to call web APIs extracted from HAR files, so network egress is expected; the destinations are not fixed in the materials and instead depend on the sites/endpoints recorded in the HAR. User prompts or parameters may be sent to third-party services referenced by the HAR, but there is no evidence of extra hidden backends or unrelated endpoints.

The system checks indicate that this tool executes code, and as an MCP server it must run locally and handle invocation logic. Based on the available materials, there is no evidence that it requests system privileges beyond its stated purpose, but local process execution should still be treated with caution.

Its functionality at minimum requires reading HAR files and generating callable API tools from them; HARs often include request bodies, response fragments, URL parameters, and identity-related data. The materials do not show a need for broad filesystem writes or excessive data access, but reading HARs alone can expose sensitive browser traffic data.

On the positive side, the project is open-source under MIT, so the code is auditable, which materially reduces opaque supply-chain risk. Caution remains because it comes from a third-party registry, has very low visible adoption (0 stars), and an unknown maintenance status, so source and dependencies should be reviewed before deployment.