io.github.llmops-pro/l402-search-mcp

The material indicates an environment variable, SEARCH_SERVICE_URL, is required; this looks more like a service endpoint than a traditional secret, and the description says it 'Holds no keys.' However, this setting still controls where requests are sent, so tampering could redirect data to an unintended service.

As a web search tool, it is expected to send query content to a remote search service; however, no fixed host is declared, and the actual destination depends on SEARCH_SERVICE_URL. There is no evidence of data being sent to clearly unrelated or hidden endpoints, but user queries may leave the local environment.

The system checks indicate that this MCP tool executes code or runs a local process, which is normal for this class of tool. The provided material does not show requests for unusual system privileges or unrelated high-risk operations, so caution is more appropriate than risk.

The available material does not indicate a need to read or write local files, databases, clipboard contents, or other sensitive resources, nor does it show excessive permission requests. The visible data access scope appears limited to receiving search queries and returning results, with no clear red flags.

The source is the official registry, with a public GitHub repository, open-source code, and updates within the last year; these are positive factors that lower risk. The missing license declaration and very low star count suggest limited ecosystem maturity, but they are not sufficient by themselves to make this high risk.