eu.ansvar/luxembourg-law-mcp

The materials explicitly state that no keys or environment variables are required. There is no request for API tokens, account credentials, or other sensitive secrets, so credential leakage and misuse risk appears low.

No remote endpoints are declared, and the documentation does not indicate that user data is sent to external services. Based on the available materials, no explicit data egress path is visible.

The system flags indicate that this tool executes code or runs a local process. This is a normal MCP capability and not, by itself, a high-risk sign, but its effective local system capabilities and permission boundaries should still be reviewed.

The description only states that it provides full-text search across Luxembourg legislation, without clearly specifying what local files, directories, or other data it may read or cache. The materials do not show overbroad access, but the data access boundaries are insufficiently documented and should be verified before deployment.

It comes from an official registry, has an auditable open-source repository, and has been updated within the last year—clear positive signals. While the missing README, undeclared license, and very low community star count reduce transparency and maturity confidence, they do not by themselves constitute a high-risk red flag.