io.github.cyanheads/noaa-spaceweather-mcp-server

The materials only show MCP_LOG_LEVEL, which is typically a logging configuration rather than a sensitive credential. No API key, OAuth token, or account password is indicated, so credential abuse risk appears low.

The tool connects to the declared endpoint noaa-spaceweather.caseyjhand.com to retrieve space weather data, which is a normal network egress capability. The materials do not specify what request content may be sent, but no unrelated or hidden exfiltration endpoint is shown, so this warrants caution rather than a high-risk rating.

System checks indicate it executes code or runs a local process, which is inherent to MCP tools. The provided materials do not show requests for unusual system privileges, unrelated command execution, or privilege escalation, so this is rated as caution.

Based on the description, its core function is to fetch space weather data, and there is no explicit claim that it needs broad local file read/write access or sensitive resources. Since an MCP process typically has some local runtime context, it should still be treated with limited file and environment exposure, but no overbroad access red flag is evident from the materials.

The tool comes from an official registry and has an open-source repository with updates within the last year, providing auditability and some maintenance signal. Although the README is absent, the license is undeclared, and community stars are very low, these transparency and adoption gaps do not by themselves amount to a high-risk supply-chain issue.