eu.ansvar/german-law-mcp

The materials explicitly state that no keys or environment variables are required, and there is no request for API tokens, account credentials, or other sensitive authentication data, so credential exposure and misuse risk appears low.

The description says it queries German legal materials from gesetze-im-internet.de, which implies likely network access to that stated destination. No additional remote endpoints are listed and there is no evidence of data exfiltration to unrelated third parties, but as a query-oriented MCP it should still be treated as having normal outbound network capability and monitored for actual request scope.

The objective checks flag executes-code, indicating the tool runs code/processes locally; this is a normal characteristic of MCP tools. The provided materials do not show requests for unusual system privileges or high-risk actions unrelated to its stated function, so this is a caution rather than a high-risk finding.

The documentation does not specify the exact scope of local file, database, or other resource access, so there is not enough information to confirm a minimal access surface. Since it is an executable MCP tool, some local data exposure should be assumed by default, but there is currently no clear sign of overbroad access or data access disproportionate to its legal-query purpose.

The source is an official registry entry and an open-source repository is provided, giving it reasonable auditability; it has also been updated within the last year, indicating some maintenance. Although it has 0 stars and no declared license, which reduces maturity and compliance clarity, the supply-chain posture remains relatively low risk in the absence of other red flags.