io.github.cyanheads/bls-labor-mcp-server

The materials show it requires BLS_API_KEY; this is a sensitive credential that could be abused to access the related data service if logged, leaked, or mishandled. MCP_LOG_LEVEL is not a secret, but verbose logging may increase the chance of exposing keys or request contents in logs.

The tool connects to the declared endpoint bls-labor.caseyjhand.com to fetch labor statistics, meaning request content and query parameters are sent to a remote service. The materials do not show exfiltration to unrelated or hidden endpoints, nor evidence of network behavior beyond its stated purpose.

The system checks indicate that this tool executes code or starts a local process, which is a normal MCP capability. The provided materials do not indicate requests for extra high-privilege system capabilities or execution behavior clearly disproportionate to its stated function.

From the materials, it can be confirmed that it at least handles user-initiated statistical queries and returned data; however, the missing README leaves local file access, caching, and log storage behavior insufficiently documented. There is no explicit evidence that it requests broad filesystem, browser, or unrelated resource access.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year. Caution points are the effectively missing README, no declared license, and very low community adoption (0 stars), which reduce verifiability, but these facts alone do not justify a high-risk rating.