Weather MCP Server

The materials explicitly state that no keys or environment variables are required, and there is no indication that account credentials, API tokens, or other sensitive secrets are needed, so credential exposure risk appears low.

The description says it uses the National Weather Service API for real-time forecasts and alerts, which implies network access related to its stated purpose. Although no remote host is listed in the system fields, it likely sends query data such as coordinates or state names to the weather service, which is typical for this type of tool.

The system marks it as executes-code, meaning it runs a local service/process on the host. This is normal for MCP tools, but the lack of a README prevents further verification of the exact system capabilities it may invoke.

The materials do not state that it reads sensitive files, writes to system paths, or accesses additional local resources. However, as a locally running MCP service, it inherently has whatever file/environment access its runtime account allows, and the current documentation is insufficient to confirm least-privilege behavior.

Positive factors include being open source under the MIT license, making the code auditable in principle. However, it comes from a third-party registry, has only 0 stars, unknown maintenance status, and no README, so trust is limited and the code/dependencies should be reviewed before use.