commercevault-edd-commerce-orchestrator

SUSPICIOUS. The claimed purpose is plausible for an EDD MCP server, but the actual install footprint is not coherent with the stated publisher: users are told to clone and run a personal GitHub repo, then provide EDD API secrets to it, with no clear same-org relationship or visible release trail. Data flows are purpose-aligned only if the code is trusted; here, install trust and credential forwarding concerns dominate.