Lark MCP Custom

The materials state there are no environment variables or keys, but interacting with Feishu/Lark for the declared features would typically require session, OAuth, or platform-side authorization. With no README, the credential flow and storage model are unclear, creating configuration and misuse concerns.

Although no remote endpoint is declared, the stated functionality implies communication with Feishu/Lark services and may transmit message content, calendar data, document search queries, and bitable records to that platform. There is no evidence of unrelated or suspicious exfiltration targets, but the egress scope is underdocumented.

The system flags this tool as executes-code, meaning it runs MCP service code/processes locally. This is a normal MCP capability; the provided materials do not show requests for system privileges beyond the stated purpose, but the missing README leaves the exact callable capabilities unclear.

The declared features include sending messages, managing calendars, searching documents, and reading/writing bitable records, so it can access and modify business data in the collaboration platform. There is no evidence of unrelated local file or system data access, but the data scope, permission boundaries, and least-privilege model are not described.

Positive signals include being open source under Apache 2.0, which allows source review. However, it comes from a third-party registry, has 0 stars, unknown maintenance status, and no README, reducing verifiability and maturity. There is no clear closed-source or overtly malicious red flag, so it should not be elevated to high risk.