io.github.cyanheads/nist-nvd-mcp-server

It requires NVD_API_KEY, which is a sensitive credential for accessing the NVD service; if leaked, it could enable quota abuse or expose account usage patterns. NVD_REQUEST_TIMEOUT_MS and MCP_LOG_LEVEL are configuration values rather than highly sensitive secrets.

Its stated purpose is to search and audit NIST NVD/CISA KEV-related vulnerability data, so outbound network requests are expected by function; however, the specific hosts are not listed in the provided materials. There is no evidence here that it sends user data to unrelated or unknown endpoints.

The system flags it as executes-code, meaning the MCP tool runs code/processes locally; this is a normal property of MCP tools. The materials do not show it requesting system privileges beyond what its vulnerability-query use case would normally require.

Based on the provided materials, data access likely centers on handling query inputs, returning vulnerability results, and reading environment-variable configuration; without a README or permission details, local file read/write scope is not fully transparent. There is currently no evidence of broad data access disproportionate to its stated function.

It comes from an official registry and has an auditable open-source repository with updates within the past year, both of which are positive risk-reducing signals. Although the license is not stated and community stars are low, indicating some transparency/adoption limitations, these do not amount to high-risk red flags.