io.github.cyanheads/wikidata-mcp-server

The listed environment variables are WIKIDATA_USER_AGENT, timeout settings, and log level; no high-sensitivity secrets such as API keys, OAuth tokens, or account passwords are indicated. The User-Agent may include contact information, but its sensitivity is low.

The tool is declared to connect to the remote endpoint wikidata.caseyjhand.com for entity search, SPARQL queries, and external identifier resolution; this means query contents may be sent to that service. Network access is normal for this type of tool, but the endpoint is not directly labeled as an official Wikidata domain, so the operator and privacy boundary of this proxy/mirror should be verified.

The system flags it as executes-code, meaning it runs a local MCP service process. Based on the available material, there is no evidence of unusual system privileges or actions clearly unrelated to its stated purpose, so it fits the normal caution profile for locally executed tools.

The material does not state any need to read or write specific local files, databases, or system resources; known inputs are mainly query requests and environment configuration. As a local MCP process, it theoretically has process-level file access potential, but the current documentation does not show data access beyond what its functionality would normally require.

It comes from the official registry and has an open-source GitHub repository with updates within the last year, providing auditability and signs of maintenance. While the low star count and unspecified license add some adoption and compliance uncertainty, they do not by themselves constitute a high-risk red flag.