commercevault-edd-mcp-server

SUSPICIOUS. The business purpose is coherent, and the documented data flow to the official EDD API is plausible, but the install trust is not: the stated publisher does not match the GitHub source, provenance is weak, and the server is expected to receive live EDD credentials plus permission to perform order/product writes. This is disproportionate supply-chain risk for an MCP server unless the publisher/source relationship and code artifacts are independently verified.