io.github.CSOAI-ORG/uk-ai-act-mcp

Assess UK AI compliance and classify system risk levels.

Source

Official Registry

Updated

2026-08-19

// securityCaution

Runs locally
Official / curated
Open source
Community-trusted

Summary

This MCP tool has very limited documentation, but the known facts indicate it is an open-source project from an official registry with no declared secrets or remote endpoints, suggesting relatively low overall risk. It should still be treated with caution because MCP tools inherently execute locally, but the provided material shows no clear red flags such as overreach, exfiltration, or credential abuse.

CredentialsLow risk

The material explicitly states that no keys or environment variables are required, and no API keys, tokens, or account credentials are mentioned; based on the available facts, credential exposure and abuse risk appears low.

Network egressLow risk

No remote endpoint host is declared, and the material does not describe any need to connect to external services or upload user data; no explicit data egress path is evident.

Code executionCaution

The system flags this tool as executes-code, meaning it can run code or processes locally; this is a normal MCP-tool capability and warrants caution, but the material does not show requests for privileges beyond its stated purpose.

Data accessCaution

The material does not specify the exact data read/write scope; as an executable MCP tool, it may typically access local inputs or workspace data, so it should be deployed with least privilege. No explicit overbroad authorization or sensitive resource access is described.

Supply chainCaution

Positive signals include the official registry, an open-source repository, recent maintenance within the last year, and system flags for official source/community trust; these materially reduce supply-chain risk. However, the lack of a README, no declared license, and very low adoption (0 stars) limit auditability and maturity evidence, so fully safe would be premature.

Recommendations

Review the repository source code and dependency list before installation, especially for any undeclared networking or file-access behavior.
Run it in an isolated environment and restrict filesystem permissions to the minimum required scope.
Re-audit if future versions introduce environment variables, remote endpoints, or telemetry behavior.
Verify the license status and the provenance of release artifacts, and avoid using non-traceable build outputs.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.CSOAI-ORG/uk-ai-act-mcp" MCP server from askskill:
Run: claude mcp add 'io-github-csoai-org-uk-ai-act-mcp' -- npx -y uk-ai-act-mcp