io.github.cyanheads/federal-regulations-mcp-server

The materials show it requires REGULATIONS_GOV_API_KEY; this is a credential for accessing an external regulations data service and should be treated as sensitive, not exposed in logs, repositories, or shared environments. MCP_LOG_LEVEL is not a secret, but verbose logging may increase exposure of request-related details.

The system checks indicate it connects to federal-regulations.caseyjhand.com. Based on the description, its functionality relies on remote lookups of federal regulations data, so user queries may be sent to that stated endpoint as part of normal operation; the materials do not show unrelated or hidden exfiltration targets.

The system flags executes-code, indicating this MCP tool runs a local service process or related code on the host. This is a standard MCP capability; the provided materials do not show requests for privileged system access or dangerous execution beyond its stated regulations-search purpose.

The materials do not specify the exact local file read/write scope; as an MCP service, it will typically access its own runtime configuration and environment variables at minimum. No explicit overbroad data access is stated, but its visible directories, logs, and environment variables should still be constrained by default.

It comes from the official registry and provides an open-source repository with updates within the last year, which are strong positive signals. While community adoption is low and the license is unspecified, the auditable source code and official source support a low supply-chain risk rating.