io.github.cyanheads/finnhub-mcp-server

It requires FINNHUB_API_KEY, which is a sensitive credential for accessing an external financial data service; FINNHUB_BASE_URL also affects where that credential is sent. The materials do not describe credential storage, encryption, or least-privilege handling, so care is needed to avoid leakage via logs, configs, or a misconfigured base URL.

Its described functionality implies outbound requests to a Finnhub-like remote API for quotes, fundamentals, and news. Although no fixed host is listed in metadata, the configurable FINNHUB_BASE_URL means the egress destination is variable. This is a normal capability for a data-access tool, and there is no clear evidence here of sending data to unrelated or unknown endpoints.

As an MCP tool, it runs a local server process and executes its implementation code, which is inherent to this category. The provided materials do not indicate extra shell invocation, system component installation, or privileges beyond its stated purpose, so this is best treated as a standard caution rather than a high-risk issue.

The provided materials only indicate remote financial data retrieval and do not claim local file read/write access, database access, browser access, clipboard access, or other sensitive host resources. Aside from reading environment variables and handling user queries, there is no sign of excessive data access in the available information.

It is listed in the official registry, has a public GitHub repository, and was updated within the last year—these are strong positive signals. However, the lack of a README, no declared license, and very low community adoption (0 stars) reduce auditability and ecosystem validation. Overall, supply-chain risk appears manageable but source and dependency review is still advisable.