io.github.Perufitlife/aviation-mcp

The materials and checks indicate no required keys or environment variables; there is no sign that account credentials, API tokens, or local secrets must be provided, so credential exposure appears low.

The tool connects to the remote endpoint renzomacar--aviation-mcp.apify.actor to provide live aviation data; this means user queries may be sent to that Apify-hosted service, but the materials do not show unrelated or unexplained multi-endpoint exfiltration.

System checks show that this MCP executes code / starts a local process; this is a common MCP behavior, and the current materials do not indicate unusual system privileges or dangerous actions unrelated to aviation data.

The description only states that it provides aviation data such as METAR, airports, aircraft, glossary, and FAA questions, and does not explicitly claim read/write access to specific local files or broad user data; however, as a locally running MCP, its accessible data scope should still be constrained by default.

Positive signals include listing in the official registry, an auditable open-source repository, and updates within the last year; however, the missing README, undeclared license, and very low community adoption (0 stars) leave documentation and community validation limited, so some supply-chain caution remains warranted.