io.github.cyanheads/worldbank-mcp-server

Requires environment/config variables (MCP_LOG_LEVEL, WORLDBANK_API_BASE_URL, WORLDBANK_DEFAULT_PER_PAGE); these are logging and API/pagination settings, not secret credentials, but misconfiguration or leakage should still be considered.

It connects to the declared endpoint worldbank.caseyjhand.com to query World Bank data; no evidence of data being sent to unknown third parties, but request parameters and query content are transmitted to that endpoint as normal egress.

System checks indicate code execution/local process activity, which is normal for MCP tools; there is no evidence of extra system privileges or arbitrary code download/execute behavior.

Its stated purpose is to read public World Bank indicator data, with no indication of local file read/write or access beyond query use; treat any sensitive query content cautiously as with any network tool.

It comes from an official Registry with an open-source repository and updates within the last year, making the supply chain auditable and relatively trustworthy; although the license is unspecified and community adoption is low, there are no signs of abandonment or injection.