io.github.cyanheads/nonprofit-explorer-mcp-server

The only listed environment variable is MCP_LOG_LEVEL, which appears to be a logging configuration rather than a sensitive credential; no API key, OAuth token, or account password is indicated, so credential leakage/abuse risk appears low from the provided materials.

The tool is declared to access nonprofit-explorer.caseyjhand.com, and its functionality inherently depends on remotely retrieving ProPublica/IRS-related data; this implies routine outbound transmission of query content to the stated endpoint, with no evidence of unrelated or undisclosed destinations in the provided materials.

System checks indicate this MCP tool executes code/spawns a process, which is normal for an MCP server; the available materials do not show requests for system privileges beyond its stated function, nor suspicious command execution or persistence behavior.

Based on the materials, it primarily handles query requests and returned nonprofit financial data; there is no explicit statement that it needs broad local file reads, writes to sensitive directories, or access to unrelated resources, but as an MCP process its host-side data visibility should still be constrained by default.

Positive signals include an official registry source, an auditable open-source repository, and updates within the last year; however, the missing README, unspecified license, and very low community adoption (0 stars) weaken available context and ecosystem trust, so source and dependencies should be reviewed directly.