io.github.cyanheads/openfec-mcp-server

It requires FEC_API_KEY, which is a credential that could be abused if exposed; the materials do not indicate any additional highly sensitive system-level secrets. MCP_LOG_LEVEL is mainly a configuration variable rather than a secret, but overly verbose logging could increase exposure of sensitive request details.

It connects to the declared remote endpoint openfec.caseyjhand.com to query FEC data, which is routine network behavior for this type of tool. By function, user query content may be sent to that service, but the materials do not show data being exfiltrated to unrelated or unknown third-party endpoints.

The system flags indicate it executes code/spawns a process, which is a normal runtime property of MCP tools. The provided materials do not indicate requests for high-risk system privileges beyond data-query use, nor do they show red flags such as arbitrary script execution, privilege escalation, or persistence.

From the materials, it clearly needs access to the network and to configuration/secrets via environment variables; there is no README describing any specific local file, database, or other resource access scope. Because documentation is missing, data access boundaries are only moderately transparent, but there is no current evidence of obvious over-privilege.

It comes from an official registry, has an open-source repository, and has been updated within the last year—positive signals that lower supply-chain risk and make the code auditable in principle. The missing license, low star count, and absent README suggest limited maturity and documentation, but based on the available facts this is not enough to elevate it to high risk.