Ansvar: Dutch Law

The material says there are no required keys/environment variables, but the description mentions 'OAuth + paid tier,' which suggests account authorization or token exchange may occur in practice. No manual local secret injection is shown, so credential risk appears limited, but the authentication details are not fully disclosed and token storage/reuse should be checked.

It is known to connect to gateway.ansvar.eu, and the tool's function inherently depends on a remote gateway for Dutch law content; user queries will likely be sent to that declared endpoint. There is no evidence of egress to unrelated or unknown domains, so this is normal in-scope network behavior.

The system flags indicate code execution/process startup, which is standard MCP tool behavior. The materials do not show shell elevation, persistent background control, or system capabilities beyond the stated purpose, so this should be treated as ordinary local execution rather than high risk.

The available materials only indicate a legal-query function and do not claim local file read/write access, system directory access, browser access, database access, or other sensitive resources; no sign of excessive data access is shown. Reassessment would be needed only if the real installation grants broader local resources.

The source is an official registry entry and there is an auditable open-source repository with updates within the last year; these are clear risk-reducing factors. The undeclared license and very low star count mean limited independent community validation, but based on the available facts this is not enough to raise it to high risk.