io.github.cyanheads/aviation-weather-mcp-server

The materials only list configuration-style environment variables (MCP_LOG_LEVEL, AWC_BASE_URL, AWC_TIMEOUT_MS) and do not indicate any API key, OAuth token, or other sensitive secret; credential abuse risk appears low, though environment values should still not be exposed in shared logs.

The tool connects to aviation-weather.caseyjhand.com to retrieve METAR/TAF/PIREP/SIGMET/AIRMET data, which is consistent with its stated purpose. The materials do not indicate sharing data with unrelated third parties, but user queries and request metadata may still be visible to that remote service.

The system indicates executes-code, meaning this MCP tool runs as local code/processes. Based on the available materials, there is no evidence of requesting system privileges unrelated to weather retrieval, but it should still be treated as an executable third-party tool and sandboxed appropriately.

The materials do not describe any need to read or write local files, databases, clipboard contents, or other sensitive resources. Its data access surface appears narrow and primarily limited to handling network requests and responses, with no clear sign of overbroad access.

This tool is listed in an official registry, is open source, and has been updated within the last year, all of which are meaningful risk-reducing signals. However, the repository does not state a license and shows low community adoption (0 stars), so public ecosystem validation is limited; caution is appropriate, but not a high-risk rating.