io.github.cyanheads/musicbrainz-mcp-server

The materials show requirements for MUSICBRAINZ_CONTACT and MCP_LOG_LEVEL. The former appears to be contact metadata rather than a highly sensitive API key, but it is still a configuration item and could expose personal contact details if logs or environment variables are leaked.

The tool is declared to connect to musicbrainz.caseyjhand.com for remote lookups, which is consistent with its music metadata retrieval purpose. The materials do not show exfiltration to unrelated or unknown endpoints, though user queries may be transmitted to that service.

System checks indicate that this MCP tool executes code or starts a local process, which is normal for this class of tool. The materials do not show requests for system privileges beyond its stated functionality.

Based on the materials, data access appears mainly limited to music lookup requests and returned results, with no indication of broad filesystem read/write or unrelated data permissions. However, as an MCP process, its effective local access should still be minimized through runtime configuration.

The source is an official registry entry with an auditable open-source repository and updates within the last year, all of which materially reduce risk. While the low star count and undeclared license add some adoption and compliance uncertainty, they do not amount to a high-risk red flag.