io.github.3121n/nve-mcp

The materials explicitly state that no keys or environment variables are required. There is no indication that API keys, account tokens, or other sensitive credentials are needed, so credential exposure and abuse risk appears low based on the available facts.

The description indicates that the tool provides NVE flood and landslide hazard data, which normally implies outbound queries to an external data source. However, no remote host is declared in the materials, so the actual egress destinations and transmitted content are insufficiently documented and should be verified to ensure they are limited to services relevant to the stated purpose.

The system checks mark this tool as executes-code, indicating the normal ability to run code or processes locally. This is an inherent characteristic of such tools and does not by itself justify a high-risk rating, but the materials do not describe the precise boundaries of system capabilities available to it.

The available materials do not state that the tool needs to read or write local files, databases, or other user data resources. From the description, it appears to query hazard data by coordinate. There is no clear sign of overbroad access, though the missing README means actual file access behavior should still be checked before use.

There are meaningful positive supply-chain signals: official registry origin, an auditable open-source repository, and updates within the last year, all of which reduce risk. However, the repository has no declared license, community adoption is very low (0 stars), and documentation is absent, so visibility and ecosystem validation remain limited; caution is appropriate rather than high risk.