io.github.cyanheads/bluesky-mcp-server

The only listed environment variable is MCP_LOG_LEVEL, which is typically a logging configuration rather than an authentication secret. No API key, OAuth token, or other sensitive credential is indicated, so credential leakage and abuse risk appears low.

The tool declares outbound connectivity to bluesky.caseyjhand.com to provide Bluesky search functionality, which is a normal network behavior for this type of tool. The materials do not specify exact payloads or whether user queries/results are forwarded in detail, so user input should be assumed to potentially transit to that endpoint and minimized accordingly.

The system checks indicate that this tool executes code locally as an MCP service, which is inherent to this class of tools. The available materials do not show requests for unusual system privileges, unrelated command execution, or suspicious persistence, so this does not by itself rise to a high-risk red flag.

The description is limited to searching posts, profiles, feeds, threads, and trends, with no stated need to read or write local files, databases, clipboard data, or other sensitive resources. Based on the materials, there is no clear sign of excessive data access.

It comes from the official registry and has a public GitHub repository with updates within the last year, which are meaningful risk-reducing signals. However, the lack of a README, no declared license, and very low community adoption (0 stars) limit audit context and maturity, so validating it first in an isolated environment is advisable.