io.github.cyanheads/usaspending-mcp-server

The only declared environment variable is MCP_LOG_LEVEL, which is typically a logging configuration rather than a sensitive secret; no API key, OAuth token, or cloud credential is indicated, so credential abuse risk appears low.

The tool connects to the remote endpoint usaspending.caseyjhand.com to deliver its stated data-query functionality; such outbound access is normal for this class of tool. However, the materials do not explain this domain's relationship to official USAspending.gov services, and the missing README prevents confirming what query content or telemetry may be sent.

The system checks indicate that this MCP tool executes code / runs a local process, which is standard MCP behavior. The available materials do not show requests for unusual system-level privileges, nor do they describe execution capabilities clearly unrelated to its stated function.

Based on the description, its primary access target should be federal spending and recipient data; however, the missing README leaves local file read/write scope, cache behavior, and query logging unspecified. There is no clear evidence of overbroad access, but the data-access boundary is underdocumented.

Positive signals include official registry distribution, an auditable open-source repository, and updates within the last year, all of which materially reduce supply-chain risk. Still, the license is unspecified, community adoption is very low (0 stars), and missing documentation makes review harder, so source and dependency inspection is advisable before deployment.