io.github.cyanheads/un-comtrade-mcp-server

It requires COMTRADE_SUBSCRIPTION_KEY, which is a sensitive credential for accessing an external data service; if exposed, it could enable quota abuse or unauthorized API calls. MCP_LOG_LEVEL is not a sensitive secret.

The described functionality indicates normal outbound access to UN Comtrade data services, implying expected network egress; however, the specific remote host is not explicitly disclosed in the materials. Based on the available facts, there is no clear red flag showing data exfiltration to unrelated third parties.

The system flags it as executes-code, meaning the MCP tool runs locally as a process and executes its own logic. This is a standard capability for MCP tools; the materials do not show requests for unusual system privileges or suspicious execution behavior.

Based on the available description, the tool primarily provides international trade statistics queries and does not claim broad local file read/write access, unrelated data directory access, or excessive resource permissions. Aside from reading required environment variables, the materials do not indicate expanded local data access.

It comes from an official registry, is open-source, and has been updated within the last year, all of which are meaningful risk-reducing signals. However, the missing README, unspecified license, and 0 GitHub stars mean audit context and ecosystem validation are still limited, so source and dependency review is advisable before deployment.