io.github.cyanheads/who-gho-mcp-server

The only declared environment variable is MCP_LOG_LEVEL, which appears to be a logging configuration rather than an access token, API key, or account credential; no sensitive credential collection or explicit credential abuse risk is evident.

The tool declares outbound access to who-gho.caseyjhand.com, which is a clear remote endpoint connection. Based on the stated function, user queries or request parameters may be sent to that endpoint, but the available material does not show a red flag of broad exfiltration to unrelated or unknown third parties.

System checks indicate it executes code/spawns processes, which is a standard operational trait for MCP tools. The provided material does not disclose system privileges beyond its stated purpose, persistence mechanisms, or suspicious command execution behavior, so this warrants caution but not a high-risk rating.

The available material does not specify which local files, directories, or other resources it can read or write, so the data access boundary is not transparent. There is no explicit request for broad filesystem permissions or unrelated data access, but as an MCP service it should still be treated under least-privilege assumptions.

Positive factors include official registry provenance, an open-source repository, and updates within the last year. Points of caution are the lack of a README, no declared license, and very low community adoption (0 stars), which limit audit context and external validation; however, these gaps alone do not constitute a high-risk red flag.