io.github.cyanheads/eia-energy-mcp-server

The materials show it requires EIA_API_KEY, which is a sensitive credential for accessing an external data service; the other environment variables appear to be TTL, logging, and feature toggles with lower sensitivity. No unusually privileged credential is requested, but the API key should still be protected from leakage via logs, config files, or shared environments.

The known remote endpoint is eia-energy.caseyjhand.com, and network egress is expected because the tool’s stated purpose is to browse and query EIA data. The materials do not clarify whether data is also sent to other third-party endpoints or whether user queries are proxied through this host, so transparency is limited but there is no explicit red flag.

The system checks indicate it executes code or starts a local process, which is a normal operating pattern for MCP tools. The available materials do not show requests for system privileges beyond what is needed to query EIA data, nor do they provide evidence of arbitrary script execution or dangerous command use.

The environment variables suggest possible local caching or data retention controls (such as EIA_DATASET_TTL_SECONDS and EIA_DATAFRAME_DROP_ENABLED), indicating it may process or temporarily store query results locally. The materials do not specify exact file paths, scope of read/write access, or whether unrelated local data is touched, so this warrants caution but there is no evidence of overbroad access.

It is listed in the official registry, has an open-source repository, and was updated within the last year, all of which are positive signals. On the other hand, the missing README, undeclared license, and very low community adoption (0 stars) limit auditability and maturity, so supply-chain risk is not high but manual review of source code and dependencies is still advisable.