eu.ansvar/greek-law-mcp

The material explicitly states that no keys or environment variables are required. No token, API key, or account credential configuration is described, so credential leakage and abuse exposure appears low.

No remote endpoint is declared, and the material does not mention external APIs, cloud services, or upload paths. Based on the available information, there is no explicit design indicating user data egress.

The system checks indicate that this tool executes code; as an MCP service, that typically means starting a local process and handling requests. This normal capability alone is not a high-risk signal, but its runtime system capabilities and permission boundaries should be monitored.

Its stated function is full-text search over Greek legislation, which likely requires access to local indexes, bundled datasets, or runtime-directory resources; the exact read/write scope is not described. There is no clear evidence of overbroad access, but the data-access boundary is not very transparent.

The source is an official registry entry, with an auditable open-source repository and updates within the last year; these are clear risk-reducing signals. While the project has low community adoption and no declared license, which reduces maturity and compliance transparency, there is still no clear high-risk supply-chain red flag in the provided material.