Geocoding

It requires the GEOCODE_USER_AGENT environment variable. This appears more like a request identifier than a highly sensitive API key, but it is still a configuration secret; if it contains identifying org/personal data or is reused elsewhere, there is limited leakage or misuse risk.

The description says it uses OpenStreetMap Nominatim for forward/reverse geocoding, place search, and distance, implying that query content is sent to a geocoding service related to its stated purpose. The materials do not list a concrete host, so endpoint transparency is incomplete; location/address data in user queries should be treated as outbound.

System checks indicate that the tool executes code/starts a local process, which is normal MCP behavior. The materials do not show requests for elevated system privileges or actions unrelated to geocoding, so there is no concrete red flag here to raise it to high risk.

The available materials do not specify which local files, databases, or other resources it can read or write; as a normal MCP tool, it can at least access session inputs used for geocoding queries. No explicit overbroad access is described, but missing documentation leaves the true data-access boundary insufficiently transparent.

It is listed in an official registry, has an auditable open-source repository, and was updated within the last year—clear risk-reducing factors. Although it lacks README/license detail and has very low community adoption, there is no sign of a closed-source, unknown, or abandoned supply-chain red flag.