io.github.Akhilgovind02/india-regulatory-mcp

The materials explicitly state that there are no required keys or environment variables, and the description says “no API keys”; no account, token, or other sensitive credential requirement is shown, so credential exposure and abuse risk appears low.

No remote endpoint is declared, and the functionality is described as using an “Offline SQLite index,” with no evidence that user queries or data are sent to external services. Based on the available materials, network egress risk appears low.

The system checks indicate that this tool executes code; this is a normal MCP capability and means a local process must be started and run. The materials do not show requests for unusual system privileges, but it should still be treated as local code execution and run in a constrained environment.

The description indicates it uses a local offline SQLite index to search regulatory materials, which usually implies access to its own index data and files in its runtime directory. There is no indication that it requires broad read/write access to user files or system resources, but documentation is sparse, so its filesystem visibility should be limited.

Positive factors include an official registry source, an open-source repository available for audit, and updates within the last year; these materially reduce supply-chain risk. Caveats are the missing README, undeclared license, and very low adoption (0 stars), so while it is auditable, evidence of maturity is limited.