io.github.cyanheads/openstates-mcp-server

It requires an OPENSTATES_API_KEY, which is a sensitive credential and could be abused to access the related OpenStates service if exposed. The materials do not show additional highly privileged system credentials or obvious credential-abuse mechanisms.

It declares outbound connections to openstates.caseyjhand.com, a known endpoint related to its stated function. Based on the description, it is used to query legislative data; however, the materials do not specify request contents or logging behavior, so user queries should be assumed to be sent remotely.

System checks indicate that the tool executes code or runs a local process, which is a standard operating pattern for MCP services. The available materials do not show requests for system privileges unrelated to its stated purpose, nor a suspicious execution chain.

No README or permission details are provided, so the exact read/write scope cannot be confirmed; as an MCP tool, it would typically access runtime environment variables (such as the API key) and process user-provided query data. There is no clear evidence of overbroad access, but transparency is limited.

Positive signals include an official registry source, an open-source repository that can be audited, and updates within the last year. Caution is still warranted because the license is unspecified, the README is missing, and community adoption is 0 stars, which weakens transparency and external validation, though not enough on its own to classify it as high risk.