io.github.cyanheads/ourairports-mcp-server

The only listed environment variable is MCP_LOG_LEVEL, which is typically a log-level setting rather than a sensitive secret; no API key, account password, or high-value token is indicated, so credential abuse risk appears low.

The tool is declared to access ourairports.caseyjhand.com, which aligns with its aviation data lookup function. The materials do not specify whether user prompts or context are sent out, but it does have network egress to a declared endpoint, so normal caution is warranted.

The system indicates this MCP tool executes code/runs as a local process, which is standard for MCP services. The available materials do not show requests for unusual system privileges or actions unrelated to its stated purpose, so this is routine caution rather than high risk.

No README or explicit data-permission boundaries are provided, so the exact scope of local file, cache, or log access cannot be confirmed. There is no clear evidence of overbroad access, but as a local-running tool it should be assumed to potentially handle data and logs provided during use.

It comes from an official registry and has public source code with updates within the last year, which are positive signals. However, the repository has no declared license, low community adoption (0 stars), and no README, limiting audit context and leaving supply-chain transparency only moderate.