ToolProof Trust Profile

ai-smithery-ref-tools-ref-tools-mcp

Remote context/data exposure profile. Review what prompts, queries, or returned context may leave the local environment.

100risk score

Connect With Limitsconnection signal

remote_context_data_exposurerisk type

86evidence score

Source: https://github.com/ref-tools/ref-tools-mcp
Registry: ai.smithery/ref-tools-ref-tools-mcp 3.0.0

Connection signal

Remote context/data exposure profile. Review what prompts, queries, or returned context may leave the local environment.

Observed tools

None observed in this static profile.

Top findings

Detected capability: environment_access — index.ts:238
References credential or secret pattern: API_KEY_GENERIC — index.ts:230
Detected capability: network_egress — index.ts:279

Recommended controls

Install in a sandbox before team or production use.
Pin the exact package/repository version.
Review install scripts, Dockerfile behavior, and dependency pins.
Do not use production credentials during first install.
Restrict filesystem, repository, cloud, and database scope.
Require human approval for destructive actions.
Review what prompts, queries, or documents are sent to remote endpoints.
Avoid sensitive context until data handling is understood.