io.github.ibeal/tidal-mcp

The material only shows the environment variable TIDAL_MCP_PORT; this looks more like a local port configuration than a third-party service secret, so sensitivity appears low. However, it is flagged as requiring credentials and there is no README explaining its purpose, so it should still be handled cautiously as a configuration item.

Declared remote endpoints are empty, but its features—track search, playlist management, and personalized recommendations—normally imply interaction with TIDAL services. The current material does not list specific hosts or data flows, so the egress scope cannot be confirmed; this warrants caution but does not present a concrete high-risk red flag.

The system explicitly flags it as executes-code, meaning it runs code or starts a local process; this is a normal MCP tool capability. The material does not show requests for unusual system privileges or execution behavior unrelated to its stated purpose, so caution is appropriate.

Per the description, it can search tracks, manage playlists, and provide personalized recommendations, which implies access to TIDAL account-related media data and preference information. The material does not mention extra local file read/write access or permissions beyond the music-service context; there is no evidence of overbroad access, but the data scope does include personal usage preferences and merits caution.

The source is an official registry entry with an open-source repository and updates within the last year, providing auditability and some maintenance signal; these are clear risk-reducing factors. Although the README is absent, community stars are low, and the license is unspecified, the transparency is only moderate and does not by itself justify a high-risk rating.