io.github.SAP/fiori-mcp-server

The listed variables, LOG_LEVEL and SAP_UX_FIORI_TOOLS_DISABLE_TELEMETRY, appear to be local configuration/feature flags rather than API keys, tokens, or account credentials; based on the provided facts, credential exposure and misuse risk is low.

No remote host is declared, and the material does not state that user data is sent to any specific third-party service. However, the presence of a telemetry-disable environment variable suggests possible telemetry-related outbound traffic, while the documentation does not specify endpoints or data scope; verify this at deployment time and disable it if not needed.

The system checks explicitly indicate code-execution capability, meaning it may start local processes or invoke development-related system capabilities. This is a normal characteristic for MCP/developer tools, but it should still be run in a controlled environment with limited host privileges.

No README or detailed permission description is provided, so the exact read/write scope cannot be confirmed. Given that it is a Fiori-related MCP tool with code-execution capability, it is reasonable to expect access to local project/workspace files. There is no clear evidence of overbroad access in the provided material, but least-privilege workspace scoping is recommended.

The source is an official registry and there is an auditable SAP open-source repository with updates within the last year; these are strong positive signals. Although the missing README and low star count reduce transparency and community validation, they are not sufficient to raise this to high risk in the absence of other red flags.