io.github.cyanheads/noaa-marine-mcp-server

The materials indicate NOAA_APPLICATION_ID and MCP_LOG_LEVEL are required; the truly sensitive item is NOAA_APPLICATION_ID, an external service application identifier that could be abused for API quota usage or account-associated configuration if exposed. MCP_LOG_LEVEL is not itself a secret.

The tool connects to the declared endpoint noaa-marine.caseyjhand.com to retrieve marine-related data. This network behavior is consistent with its stated purpose, but user queries and request metadata may be sent to that remote service, so normal outbound data handling caution applies.

The system flags indicate this MCP tool executes code/runs as a local process, which is a standard capability for MCP tools. The available materials do not show requests for unusual system privileges unrelated to marine data retrieval, so this alone does not justify a high-risk rating.

The materials only state that it finds tide stations and buoys and fetches predictions and live conditions; there is no stated need for broad local file, database, or other sensitive resource access. Based on the available information, there is no clear sign of excessive data access.

It comes from an official registry, has an auditable open-source repository, and has been updated within the past year, all of which are meaningful risk-reducing factors. While the license is undeclared and the star count is low, there are no current supply-chain red flags such as closed source, abandonment, or dubious origin.