io.github.dachhack/stathead-mcp

The materials explicitly state that no keys or environment variables are required. No API tokens, account credentials, or other sensitive secrets are requested, so credential exposure and abuse risk appears low.

No remote host endpoints are declared, and the materials do not state that user data is sent to third-party services. Based on the available facts, there is no explicit data egress path, though README details are missing and network behavior is not fully documented.

The system flags executes-code, indicating that the tool runs code or processes locally. This is a normal capability for an MCP tool, but it still means the runtime environment should be constrained and its actual local system actions should be monitored.

The description includes 'Excel I/O', so it is reasonable to infer the ability to read/write local Excel files or related data. This scope appears aligned with its stated analytics purpose, and no excessive system-level permissions are evident, but only necessary files should be exposed.

The source is the official registry and there is an auditable open-source repository with updates within the last year, all of which are strong risk-reducing signals. Although no license is declared, community stars are low, and the README is missing, these transparency and maturity gaps do not by themselves amount to a high-risk red flag.