io.github.cyanheads/federal-reserve-mcp-server

It requires FRED_API_KEY, which is a sensitive credential for accessing an external data service; if exposed, it could be abused to call the FRED API. The other environment variables appear to be configuration settings rather than highly sensitive secrets, but they should still not be exposed through logs or shared configs.

The tool’s stated function depends on reaching the FRED API to retrieve remote economic data, and the configurable FRED_BASE_URL indicates outbound network requests. No fixed host is listed in the material, and there is no evidence of sending user data to unrelated third parties, but the BASE_URL should be verified to ensure it is not redirected to an unexpected endpoint.

The system checks indicate it executes code or runs as a local process, which is standard for an MCP service. The available material only describes searching and fetching time series, and there is no evidence of unusual system-level privileges or suspicious execution beyond its stated purpose.

The environment variables suggest it may keep local cache or processing state (such as TTL and dataframe-related behavior) while handling retrieved economic data. The material does not indicate broad access to user files or excessive data permissions, and no overreach red flags are evident from the provided information.

It comes from an official registry, has an open-source repository, and has been updated within the past year, all of which materially reduce supply-chain risk. Although community stars are low and the license is not declared, source review and dependency pinning are advisable; overall, the available evidence supports good auditability.