io.github.cyanheads/mcp-ts-core

Only MCP_LOG_LEVEL is declared as an environment variable; by name it appears to be a logging-level setting rather than a sensitive credential. No API key, token, or account secret is mentioned, so credential leakage or abuse risk appears low.

The material explicitly lists no remote host endpoints, and the README does not describe any external API calls or data upload behavior. Based on the available information, there is no indication of user data being sent to third-party services.

The system flags it as executes-code, indicating local code execution and/or process-spawning capability; this is a normal high-privilege property of MCP tools. The material does not define finer system capability boundaries, so its runtime context and least-privilege setup should be reviewed, but this alone does not justify a high-risk rating.

As a framework for building MCP servers, it would commonly interact with local project files, configuration, or runtime data; however, the current material does not specify exact read/write paths, data domains, or persistence behavior. There is no clear evidence of overbroad access, but the data access scope is underdocumented, so limiting working directories and file permissions is advisable.

It comes from an official registry and has an auditable open-source repository with updates within the last year, which are strong positive supply-chain signals. While the license is unspecified, community stars are low, and the README is absent, these reduce confidence in maturity but do not amount to high-risk red flags.