prometheus-mcp-server

The materials explicitly state that no keys or environment variables are required, and there is no request for API tokens, account passwords, or other sensitive credentials, so credential exposure and misuse risk appears low.

The description says it queries and analyzes Prometheus metrics, which typically implies connecting to a Prometheus instance, but the materials do not specify endpoints or data-flow details. There is no explicit red flag showing exfiltration to unrelated third parties, but actual targets and request scope should be verified in deployment.

The system checks indicate that this tool executes code or runs a service process, which is a normal MCP capability. The current materials do not show requests for unusual system privileges or actions unrelated to its stated function, but it should still be run with least privilege.

Based on the description, its primary target should be Prometheus metrics data; however, the missing README does not explain whether it reads or writes local files, caches, logs, or configuration paths. There is no clear evidence of overbroad access, but the data-access boundary is insufficiently documented and should be reviewed in source and default configs before use.

The source is an open GitHub repository under the MIT license and is auditable, with 474 stars as a meaningful positive trust signal. Unknown maintenance status and missing documentation are weaknesses, but without other red flags they do not justify a high-risk rating.