io.github.cyanheads/wsdot-mcp-server

It requires WSDOT_ACCESS_CODE, which should be treated as a sensitive credential; if exposed, it could be abused to access the related service. MCP_LOG_LEVEL is not a secret, but verbose logging may indirectly increase the chance of sensitive data being written to logs.

The materials indicate outbound connections to wsdot.caseyjhand.com to provide highway, ferry, vessel, toll, and border-wait data. Query content or context may be sent to this declared endpoint, but the provided materials do not show exfiltration to unknown or unrelated hosts.

System checks indicate this tool can execute code or spawn a local process, which is common for MCP tools. The available materials do not describe unusual system privileges or high-risk actions unrelated to transportation data retrieval.

From the materials, it at least reads environment variables for the access code and log level, and may process user-submitted transportation queries. With no README, any additional file read/write scope is not clearly documented; no clearly excessive data access is shown, but transparency is limited.

Positive factors include listing in an official registry, an auditable open-source repository, and updates within the last year. Cautions are the missing README, no declared license, and low community adoption (0 stars), which reduce transparency and maturity, but do not by themselves amount to a high-risk red flag.