mcp-ipinfo

The materials explicitly state that no keys or environment variables are required. There is no indication of API tokens, account credentials, or sensitive local secrets being needed, so credential exposure and abuse risk appears low.

The description says the tool provides IP geolocation data via ipinfo.io, implying that queried IPs are sent to the third-party service ipinfo.io. No unknown endpoints or suspicious exfiltration are evident, but outbound network transfer exists and should be checked against privacy and compliance requirements.

The system flags that this tool executes code, meaning it runs as a local MCP service/process. Based on the materials, there is no evidence of system privileges clearly exceeding its stated purpose, so this is a standard caution for this class of tool.

The description only covers querying IP addresses and returning geolocation/ISP details. It does not claim local file reads, disk writes, database access, or access to local data beyond what is needed for the query, so no excessive data access is evident from the materials.

The project has a public GitHub repository and an MIT license, making the source auditable, which is a clear risk-reducing factor. However, it comes from a third-party registry, shows only 0 stars, and has unknown maintenance status, so maturity and ongoing maintenance signals are weak and warrant review of the code and dependencies.