io.github.cyanheads/devops-status-mcp-server

The materials only show environment variables such as MCP_LOG_LEVEL, DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS, and DEVOPS_STATUS_DISABLE_ACTIVE_PROBES, which appear to be runtime configuration flags rather than API keys or account credentials; no sensitive token requirement is evident, so credential leakage/misuse risk is low.

The tool declares connectivity to devops-status.caseyjhand.com, and its described functions include status-page, TLS certificate, and DNS propagation checks, indicating outbound network requests and possible probing of user-supplied targets. The DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS flag suggests it may reach private/internal addresses when enabled, so target scope and outbound content should be controlled.

The system marks it as executes-code, meaning it runs locally as an MCP tool and executes its checking logic. This is standard for such tools; the available materials do not show requests for system privileges beyond its stated purpose, but it should still run in a constrained environment.

Based on the description and available materials, the tool primarily accesses network target status, certificates, and DNS information, with no stated need for broad local file, database, or user-directory read/write access. There is no clear evidence of excessive data access, though probing private targets could expose internal service metadata.

It is listed in an official registry, is open-source, and has been updated within the last year, all of which lower risk. However, the lack of a README, no declared license, and very low community adoption (0 stars) limit audit context and external validation, so supply-chain confidence is moderate but cautious.