io.github.cyanheads/seerr-mcp-server

It requires SEERR_BASE_URL and SEERR_API_KEY; the API key is a sensitive credential. If exposed, it could be used to access or act against the user's Jellyseerr/Overseerr instance. The timeout and log-level variables are lower sensitivity.

No fixed third-party remote host is listed, but based on the functionality and environment variables, the tool will connect to the user-configured Jellyseerr/Overseerr base URL and send search/request-related data to that declared service endpoint. There is no evidence of exfiltration to unrelated or unknown endpoints.

The system flags indicate code execution/local MCP server runtime, but the provided materials do not show requests for unusual system privileges or arbitrary system actions unrelated to media request functionality. This local execution is a standard capability for MCP tools.

Based on the description, its access scope appears limited to search, availability, and request data within Jellyseerr/Overseerr. The materials do not indicate broad filesystem read/write permissions or data access beyond its stated purpose; however, as an MCP service it will still process user input and service responses.

It is distributed via the official registry and has an auditable open-source repository with updates within the last year, all of which materially reduce supply-chain risk. Although community stars are low and the license is not stated, auditability and source trust remain good, with no clear signs of abandonment or suspicious distribution.