io.github.cyanheads/coingecko-mcp-server

The materials indicate it requires COINGECKO_API_KEY (a sensitive credential) and MCP_LOG_LEVEL (a non-sensitive config). If the API key is exposed, it could be abused to access CoinGecko services or consume quota, but there is no indication that it requests unrelated high-privilege system credentials.

Its stated purpose is to fetch CoinGecko crypto market data, so normal outbound requests to CoinGecko-related APIs are expected. The provided materials do not list a specific remote host and show no evidence of data being sent to unknown or unrelated endpoints, but dependence on an external API still warrants attention to what is transmitted.

System checks indicate that this MCP tool executes code/runs as a local process, which is normal for this class of tool. The available materials do not show requests for system privileges beyond its data-query purpose, nor do they describe arbitrary high-risk system operations.

Based on the materials, it at least reads configuration and the API key from environment variables. The missing README does not clearly state what local files or other data resources it may access; from the current evidence there is no clear sign of over-privileged access, but transparency about local data scope is limited.

Positive factors include an official registry source, an auditable open-source repository, and updates within the last year. Cautions remain: the README is effectively absent, the license is undeclared, and community stars are very low, limiting documentation and community validation; however, these issues alone do not amount to a high-risk red flag.