kvcore-mcp-cli

SUSPICIOUS. The stated purpose is plausible for a KVcore integration, but trust is weakened by third-party publication, an unpinned `npx` install path, and incomplete transparency around required credentials and runtime behavior. No direct evidence of credential theft or malicious data routing is shown, so this is not confirmed malware, but it carries medium security risk.