io.github.cyanheads/gbif-biodiversity-mcp-server

The only listed environment variable is MCP_LOG_LEVEL, which appears to be a logging configuration rather than a sensitive secret. No API key, OAuth token, or account credential is indicated, so credential-abuse risk appears low.

The tool connects to the declared remote host gbif-biodiversity.caseyjhand.com. Since its purpose is to search remote biodiversity data, network egress is expected. The materials do not state whether user prompts or results are forwarded to any additional undeclared endpoints, and no explicit high-risk red flag is visible from the provided facts.

The system marks this tool as executes-code, meaning it runs a local MCP service process. That is a normal property for this class of tool; the materials do not show requests for unrelated high-privilege system operations, so this deserves caution but not a high-risk rating on its own.

Based on the available materials, the stated purpose is to query species taxonomy, occurrence records, datasets, and publisher information, with no explicit claim of broad local file read/write access or unrelated resource access. Still, because it runs locally as an MCP tool, its accessible data scope should be constrained by default.

The source is listed in the official registry, has a public auditable repository, and has been updated within the last year; these are meaningful positive signals. While community stars are low and the license is not declared, those factors only warrant continued attention to maintenance and dependency transparency, not a high supply-chain risk rating at present.