io.github.cyanheads/nws-weather-mcp-server

The materials list NWS_USER_AGENT and MCP_LOG_LEVEL as environment variables; MCP_LOG_LEVEL is not a sensitive credential, and NWS_USER_AGENT appears to be an access identifier rather than a high-privilege secret. It is still advisable not to place personal sensitive data in that field and to avoid logging environment variable contents.

The tool declares network access to nws.caseyjhand.com, and its weather-query functionality inherently requires outbound network access. The materials do not show exfiltration to unrelated or unknown third-party endpoints, but query inputs and request metadata may be sent to that remote host during use.

The system checks indicate that this MCP tool executes code or starts a local process, which is standard behavior for this class of tool. The materials do not indicate abnormal system privileges or dangerous actions unrelated to weather retrieval, so this alone does not justify a high-risk rating.

Based on the materials, the tool at minimum can read environment variable configuration and process user queries and returned weather data at runtime. There is no indication that it requires broad filesystem access, administrative privileges, or data access disproportionate to its purpose, but the lack of a README limits visibility.

Positive signals include an official registry source, an auditable open-source repository, and updates within the past year; these materially reduce supply-chain risk. Points to watch are the missing license declaration, low community adoption (0 stars), and sparse documentation, which make implementation and dependency boundaries harder to verify quickly.