io.github.cyanheads/eur-lex-mcp-server

The listed environment variables—CELLAR_SPARQL_ENDPOINT, EURLEX_CONTENT_BASE_URL, SPARQL_QUERY_TIMEOUT_MS, MAX_SPARQL_RESULTS, and MCP_LOG_LEVEL—look more like endpoints and runtime settings than clearly sensitive API secrets. Still, environment variables may expose internal service URLs or be logged, so there is a limited configuration leakage risk.

The tool requires network access and connects to the known remote host eur-lex.caseyjhand.com; its stated function also implies queries to EUR-Lex/CELLAR-related resources. The provided material does not show evidence of bulk exfiltration to unrelated or unknown third parties, but user query content may still be sent to the remote service as part of normal operation.

The system flags indicate that this MCP tool executes code or starts a local process, which is a normal characteristic of this class of tools. The available material does not show requests for unrelated high-privilege system access, nor clear red flags such as command injection patterns or self-updating execution behavior.

The description only indicates searching and browsing legal and knowledge-graph content, and without a README there is no concrete file read/write scope documented; at minimum, it should be assumed to access session inputs and runtime configuration as part of normal MCP operation. No evidence in the materials shows excessive data permissions beyond its stated purpose.

The source is an official registry listing, and an open-source repository is available for review, with updates within the last year; these are strong risk-reducing signals. Although community stars are low and the license is not declared, that creates some adoption and compliance uncertainty but does not by itself amount to a high-risk supply-chain red flag.