io.github.cyanheads/earthquake-mcp-server

The materials only show MCP_LOG_LEVEL, which is typically a logging-level setting rather than a sensitive secret. No API key, OAuth token, or account credential is indicated, so credential leakage or abuse risk appears low.

The tool connects to its declared remote endpoint, earthquake.caseyjhand.com, to retrieve earthquake data, which is inherent to its stated function. The materials do not explicitly define whether user queries or context are forwarded to that endpoint, so the scope of transmitted data should be monitored, but there is no clear red flag of exfiltration to unrelated or unknown destinations.

System checks indicate it executes code or runs a local process, which is normal for MCP tools. The available materials do not show requests for unusually broad system privileges beyond what its function would require, nor obvious signs of command-execution abuse, so this warrants caution rather than a high-risk rating.

The description is limited to querying USGS and EMSC earthquake data. There is no stated need to read or write local files, databases, clipboard contents, or other sensitive resources, and no sign of overbroad authorization. Based on the materials, the data-access scope appears narrow.

Positive signals include listing in the official registry, open-source code, and updates within the last year, all of which materially reduce supply-chain risk. Points to watch are the lack of a README, no declared license, and 0 stars, which limit transparency and community validation, so the overall supply-chain rating is caution rather than risk.