eu.ansvar/swedish-law-mcp

The materials explicitly state that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication secrets are requested, so credential exposure and abuse risk appears low.

No remote endpoints are declared in the materials, and there is no stated behavior of sending user data to third-party services. Based on the available information, there is no explicit data-egress path; however, the implementation details for retrieving legal materials are not documented in the README, so actual network behavior should be verified after installation.

System checks indicate that the tool executes code / runs a local process, which is a normal MCP capability and should be treated as a caution item. The materials do not show requests for unusual system privileges, nor any clearly high-risk execution behavior unrelated to its stated purpose.

As a locally running MCP tool, it may typically inherit file and data access available to the host process; the provided materials do not specify exact read/write scope and do not declare any obviously excessive permissions. Given the lack of README details, it should be run in a constrained directory and least-privilege environment.

The source is an official registry entry and there is an auditable open-source repository, with updates within the past year—these are meaningful risk-reducing factors. The low star count and missing license declaration modestly increase the need for pre-use review, but do not by themselves constitute a high-risk red flag.