MCP2OSC

The material explicitly states that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication requirements are described, so credential exposure and abuse risk appears low.

No remote host is declared, and there is no evidence of Internet-bound data exfiltration. However, its OSC control function typically implies sending control messages to local network targets or devices. The material does not specify scope or message contents, so outbound message boundaries should be reviewed.

The system checks indicate that this tool executes code. As an MCP tool, this means third-party program logic runs locally; this is a normal capability for this class of tool, but it still creates a local execution surface and should be run in a constrained environment.

The available material does not specify which local files, device configurations, or session data it reads or writes, and no explicit overbroad permission request is shown. Since it runs as a local executable tool, it should be assumed to access at least the invoking context's inputs and configuration, so accessible directories and device scope should be limited.

Positive signals include being open source, auditable, and MIT-licensed, which materially lowers supply-chain risk. On the other hand, it comes from a third-party registry, has 0 stars, unknown maintenance status, and no README content, leaving limited assurance on review depth and ongoing maintenance; caution is warranted, but not a high-risk rating.