io.github.cyanheads/orcid-mcp-server

The materials only show MCP_LOG_LEVEL, which is a logging configuration rather than a sensitive credential; no API key, OAuth token, or account password is indicated, so credential abuse risk appears low.

The tool connects to the declared remote host orcid.caseyjhand.com; consistent with its function, user queries or related context may be sent to that endpoint. The materials do not clarify whether there are additional outbound destinations or data-minimization controls, so caution is appropriate.

The checks indicate it executes code / runs an MCP service process, which is a normal capability for this type of tool. The available materials do not show requests for unusual system privileges, unrelated command execution, or obviously dangerous behavior.

Based on the description, it mainly handles researcher profiles, works, affiliations, funding, and peer review data; however, with no README, the local file read/write scope, cache locations, and any access to additional resources are not स्पष्ट. There is no evidence of overbroad access, but transparency is limited.

Positive factors include listing in an official registry, open-source availability for audit, and updates within the last year; these materially lower supply-chain risk. Points to watch are the missing license declaration, very low community adoption (0 stars), and sparse documentation, which limit independent audit and usage-validation signals.