io.github.cyanheads/college-scorecard-mcp-server

It requires SCORECARD_API_KEY (a sensitive credential) and MCP_LOG_LEVEL (a non-sensitive config). Leakage of the API key could allow misuse of the related education data service, but the provided materials show no specific red flags for credential theft or abuse beyond normal use.

Its functionality implies access to a College Scorecard-related remote service to retrieve university data; although no host is listed, the API key requirement strongly suggests network access to endpoints relevant to its stated purpose. There is no clear evidence in the materials of exfiltration to unknown or unrelated destinations.

System checks indicate that this tool executes code / starts a local process, which is a normal MCP tool capability. The materials do not indicate requests for extra high-privilege system access, and no execution-related red flags clearly disproportionate to its college-data lookup function are visible.

It is known to read configuration and credentials from environment variables at minimum. The materials do not state any need for broad read/write access to local files, databases, or other sensitive resources, and there is no described overbroad data access beyond the stated function. Because the README is missing, the exact data-access boundary should still be verified before use.

The source is an official registry entry, with a public open-source repository and updates within the last year, all of which are positive indicators. While the low star count, undeclared license, and missing README reduce auditability, there are no current signs of a closed-source, untrusted, or clearly malicious supply-chain issue.