io.github.cyanheads/onebusaway-mcp-server

It requires ONEBUSAWAY_API_KEY, ONEBUSAWAY_BASE_URL, and MCP_LOG_LEVEL; the API key is sensitive and could be abused if leaked, which is a normal risk for an API-integrating tool.

It connects to the declared remote endpoint onebusaway.caseyjhand.com to fetch real-time transit data; there is no specific red flag indicating unknown or unrelated egress.

System checks indicate it executes code/starts processes, which is a normal MCP capability; the material does not show extra high-privilege system operations or suspicious injection behavior.

Based on the description, it mainly accesses transit-stop, route, arrival, and vehicle-location API data, with no indication of local file I/O or overbroad data access.

It comes from an official registry with a public open-source repository and updates within the last year, so supply-chain trust is relatively strong; however, the license is unspecified and community adoption is 0 stars, so audit and dependency scrutiny are still warranted.