io.github.us-all/dbt

The materials show many environment variables, including sensitive credentials such as GOOGLE_APPLICATION_CREDENTIALS and PG_CONNECTION_STRING; BQ_PROJECT_ID and multiple DQ/DBT settings may also reveal data-environment details. There is a routine risk of credential leakage or misuse through logs, config files, or process environments, but no evidence of credential requests beyond the stated purpose.

The remote-endpoint field is empty, and no fixed third-party egress endpoint is declared. However, the description explicitly references BigQuery/Postgres DQ result tables, and the Google credentials plus PostgreSQL connection string indicate likely data exchange with user-configured backends. This egress appears aligned with the stated function, with no red flag suggesting transfer to unknown or unrelated endpoints.

The system flags this tool as executes-code, and runtime-control variables such as DBT_TOOLS, DBT_ALLOW_WRITE, and DBT_DISABLE suggest it likely runs dbt or related helper commands locally. Such local process execution is typical for MCP tools; the provided materials do not show requests for unusual system privileges or unrelated high-risk operations.

Based on variables such as DBT_PROJECT_DIR, DBT_TARGET_DIR, DBT_RUN_HISTORY_DIR, and DBT_SLA_CONFIG_PATH, the tool can read the dbt project, target artifacts, run history, and config files, and may write some local files or result tables when DBT_ALLOW_WRITE is enabled. This access scope matches manifest/run_results/catalog parsing and DQ recording, with no clear sign of overbroad authorization, though least-privilege configuration is still advisable.

The source is an official registry entry, with a public GitHub repository, open-source code, and updates within the last year; these are strong positive indicators. Community stars are low, which means limited external validation, but given the official source and auditability of the code, the supply-chain dimension is overall low risk.