io.github.cyanheads/hn-mcp-server

The required environment variables are only HN_CONCURRENCY_LIMIT and MCP_LOG_LEVEL, which appear to be local configuration values rather than account credentials or access tokens. No sensitive secret requirement is shown, so credential leakage or abuse risk appears low.

The tool is declared to access the remote host hn.caseyjhand.com to retrieve Hacker News-related content. This creates normal network egress exposure, but the materials only show connection to its stated endpoint and do not reveal any concrete red flags such as exfiltration to unrelated or unknown third parties.

The system checks indicate this MCP tool executes code or runs a service process, which is a normal capability for this type of tool. The available materials do not show requests for unusual system privileges or suspicious command-execution behavior.

The description only states that it browses Hacker News feeds, threads, and user profiles with full-text search, suggesting primarily network content access. Since no README or detailed permission model is provided, the scope of local file read/write access cannot be confirmed and should be checked to ensure it matches the stated functionality.

The source is listed in the official registry, and there is an open-source repository with updates in the last year, all of which are meaningful risk-reducing signals. However, community adoption is currently low (0 stars), the license is unspecified, and the missing README limits audit context, so the supply-chain posture warrants caution rather than a high-risk rating.