io.github.cyanheads/faa-aircraft-registry-mcp-server

The materials list FAA_REDACT_OWNER_PII, FAA_MIRROR_PATH, FAA_DATABASE_URL, and MCP_LOG_LEVEL as environment variables. These appear more like configuration values than typical API keys, but FAA_DATABASE_URL may contain sensitive database connection details. The “keyless” claim is not fully aligned with the presence of database-related configuration, so these values should still be handled as sensitive configuration.

System checks indicate network access to faa-aircraft-registry.caseyjhand.com, which is somewhat inconsistent with the “offline” description. However, only one declared endpoint is shown, and there is no evidence of exfiltration to unrelated or unknown third parties. In practice, users should verify whether query data is sent to that host and whether fully local operation is actually possible.

As an MCP tool, it is flagged as capable of executing code/spawning processes, which is a normal capability for this class of tools. The materials do not show requests for unusual system privileges, and there are no specific red flags indicating command execution beyond the stated aircraft registry lookup use case.

The environment variables suggest access to a local mirror path (FAA_MIRROR_PATH) and a database (FAA_DATABASE_URL), which is broadly consistent with an aircraft registry lookup function. The materials do not indicate broad unrelated file access or system-wide data privileges, but access should still be constrained to only the required directories, database, and logging configuration.

The tool comes from an official registry listing, its upstream repository is open source, and it has been updated within the last year, providing reasonable auditability and maintenance signals. Community adoption is low and the license is undeclared, so follow-up review and compliance checks are advisable, but there are no clear supply-chain high-risk red flags in the provided materials.