io.github.cyanheads/calculator-mcp-server

The listed environment variables are operational/configuration settings (such as expression length, timeout, result length, and log level), not API keys, account tokens, or other highly sensitive secrets; credential-abuse risk appears low.

The system checks indicate outbound access to calculator.caseyjhand.com; based on the tool description, user-provided mathematical expressions may be sent to that declared endpoint for processing. This is ordinary data egress, with no evidence here of transmission to unknown or unrelated domains.

The system flags it as executes-code, and its core function includes expression evaluation. For an MCP/tool, this kind of local execution or evaluation capability is a normal property; the available materials do not show requests for system privileges beyond its stated purpose or arbitrary unrelated command execution.

The available materials do not state any need to read or write local files, databases, the clipboard, or other sensitive resources. Its data scope appears limited to input mathematical expressions and calculation results, with no clear signs of overbroad access.

It is sourced from an official registry and has a public open-source repository with updates within the last year, which are positive signals that reduce risk. While the README is sparse, the license is not declared, and community stars are low, these factors reduce audit transparency somewhat but do not alone constitute a high-risk red flag.