io.github.cyanheads/clipboard-mcp-server

The only declared environment variable is MCP_LOG_LEVEL, which appears to be a logging configuration rather than a sensitive credential; no API key, token, or account secret is indicated, so credential leakage and abuse risk is low.

No remote host is declared, and the materials do not mention any cloud service, third-party API, or upload path; based on the available facts, there is no evidence of clipboard data being sent out remotely.

This is an executable MCP component and claims to read/write the system clipboard across macOS/Linux/Windows, which typically means it runs locally and invokes OS-level clipboard capabilities. This is a normal local execution pattern for such tools, but it still warrants attention to runtime isolation and least privilege.

Its stated function is to read, write, and inspect the system clipboard, so its data access appears primarily limited to the local clipboard rather than broad filesystem access. The scope is generally aligned with its purpose, but clipboard contents may include passwords, one-time codes, or personal data, so this should still be treated as sensitive data access.

Positive signals include an official registry source, an auditable open-source repository, and updates within the last year; these materially lower the risk. However, community adoption is very low (0 stars) and the license is unspecified, so supply-chain maturity and external review signals are limited, which supports a cautious rather than high-risk rating.