Yandex Webmaster MCP Server

The third-party description explicitly says 'Requires an OAuth token,' which conflicts with the metadata claiming no credentials. An OAuth token is a sensitive credential and could expose site-management access if mishandled in config or logs; however, the materials do not show requests for obviously excessive credentials, so this is rated caution.

Its stated function is to interact with the Yandex.Webmaster API for site management, search query retrieval, and indexing checks, which implies outbound requests to an external service even though the metadata lists no remote host. The destination appears related to the declared purpose, making this normal tool behavior, but the actual domains, payloads, and scope are not disclosed in the materials.

The objective checks mark this tool as executes-code, meaning it runs a local service process or executes code on the host. This is inherent to MCP tools, and the materials do not indicate shell access, privilege escalation, or unrelated system actions, so there is no specific red flag for a higher rating.

By its stated purpose, it will access Yandex.Webmaster-related site management data, search queries, and indexing status, which may be business-sensitive. The materials do not specify whether it reads or writes local files, where it caches data, or whether it follows least-privilege design, so its access boundaries to local config and remote site data warrant caution.

Positive factors include being open source under MIT, which allows source review; however, it comes from a third-party registry, has 0 stars, unknown maintenance, no README, and inconsistencies between the description and metadata on credentials/endpoints. These are not direct signs of malice, but they reduce verifiability and maturity, so this is rated caution.