io.github.cyanheads/usda-mcp-server

It requires USDA_FDC_API_KEY, which is a credential for accessing the USDA FoodData Central API and should be protected. The materials do not indicate collection of additional highly sensitive account secrets; the main credential risk is local storage, logging exposure, or accidental sharing.

Its stated purpose is to query the USDA FoodData Central database, so network requests to USDA-related data services are expected. No explicit remote host is listed by the system checks, and the materials do not show exfiltration to unrelated or unknown endpoints, so this is a normal networked capability that warrants attention rather than a high-risk flag.

The system marks it as executes-code, meaning the MCP tool runs a local service process/code on the host. This is a standard MCP behavior; the provided materials do not show requests for high-privilege system capabilities unrelated to its food database lookup function.

Based on the materials, its main data access need is likely reading the API key from environment variables and processing user queries; there is no README evidence of broad local file, database, or resource access. Because documentation is sparse, it should still be run with least privilege and limited data exposure.

It comes from an official registry and has a public source repository with updates in the last year, all of which are meaningful risk-reducing signals. While the low GitHub star count and unspecified license add some adoption and compliance uncertainty, the auditable open-source code and trusted distribution source do not present a supply-chain red flag strong enough to raise it beyond low risk.