io.github.cyanheads/reliefweb-mcp-server

The materials show RELIEFWEB_APP_NAME and MCP_LOG_LEVEL are required. By name, they appear more like an app identifier and log level than highly sensitive secrets; however, they are still supplied via environment variables, so there is baseline exposure risk if the runtime environment or logging is misconfigured.

The tool is declared to connect to reliefweb.caseyjhand.com to perform ReliefWeb searches, which is ordinary network behavior for its stated function. The materials do not indicate transmission to unrelated endpoints or clear exfiltration red flags; however, user queries would typically be sent to that remote service for processing.

System checks indicate it executes code / runs as a local MCP service process, which is inherent to this class of tool. The provided materials do not show requests for unusual system privileges or commands unrelated to its stated purpose, so this should be treated as standard local execution risk rather than high risk.

The materials only state that it can search ReliefWeb content, and no README details indicate access to specific local files, databases, or broad system resources. As an MCP tool, it may still handle session inputs and runtime environment variables, but the current materials do not show obvious over-privileged data access.

The source is in an official registry and has a public open-source repository with updates within the last year, all of which are positive signals that reduce risk. While community stars are low and the license is unspecified, the current facts do not show a clear supply-chain red flag.