io.github.cyanheads/open-meteo-mcp-server

The listed environment variables are only MCP_LOG_LEVEL and CANVAS_PROVIDER_TYPE, which do not appear to be account secrets or access tokens. There is no evidence that it requires third-party API keys, OAuth credentials, or other highly sensitive secrets; credential abuse exposure appears low.

The tool declares outbound access to the remote host open-meteo.caseyjhand.com to support weather, geocoding, marine, and air-quality queries. This means user query content may be sent to that endpoint. The provided materials do not describe data minimization, retention, or a privacy policy, so the scope of outbound data deserves attention.

System checks indicate that this MCP tool executes code or runs a local process, which is a normal operating pattern for an MCP service. The materials do not show requests for system privileges unrelated to weather functionality, nor any suspicious command-execution behavior.

The available materials do not specify what local files, directories, or other data resources it can read or write, so it is unclear whether it limits itself to necessary configuration only. There is no evidence of access requests disproportionate to its stated function, but the missing documentation makes data-access boundaries less transparent.

It comes from an official registry and has a public source repository with updates within the last year, which are positive risk-reducing signals. However, the lack of a README, no declared license, and 0-star community adoption indicate limited maturity and weaker auditability, so dependencies and implementation should still be reviewed before deployment.