io.github.cyanheads/faostat-mcp-server

The materials list several environment variables: FAOSTAT_DOMAINS, FAOSTAT_MIRROR_PATH, FAOSTAT_BULK_BASE_URL, CANVAS_PROVIDER_TYPE, and MCP_LOG_LEVEL. By name they look more like configuration values than classic high-sensitivity API secrets, but they may still reveal local paths, data-source configuration, or runtime mode and should be handled as configuration secrets.

It is known to connect to faostat.caseyjhand.com, and the description indicates access to FAOSTAT data via a local mirror, so network communication to a declared endpoint is expected. The materials do not specify what exact user inputs or telemetry may be sent, but there is no stated unrelated or unknown third-party endpoint.

The system checks explicitly mark this tool as executes-code, meaning it runs code/processes locally; this is a normal MCP capability. The available materials do not show requests for clearly excessive system privileges unrelated to statistical data access, nor any suspicious execution chain.

The description explicitly mentions a 'local SQLite mirror,' and the FAOSTAT_MIRROR_PATH variable indicates access to local mirror files/paths. Based on the materials, this access appears aligned with its stated function, but the missing README leaves the exact read/write scope, cache locations, and whether it modifies the local mirror unspecified.

The source is in the official registry, with a public source repository and updates within the past year, providing auditability and some maintenance signals; these are positive factors that reduce risk. The missing license, very low community stars, and absent README do limit transparency, but they are not by themselves enough to make it high risk.