io.github.malkreide/fedlex-mcp

The material explicitly states that no keys or environment variables are required. There is no indication that it requests API tokens, account credentials, or local sensitive authentication data, so credential exposure risk appears low.

The description says it uses the Fedlex SPARQL endpoint for Swiss federal law, indicating outbound network access. Although no host is listed in the system fields, the stated purpose is consistent with that external connection. The material does not clarify whether user queries or any telemetry are forwarded, so the actual scope of outbound requests should be reviewed.

The system checks indicate that this MCP executes code or starts a local process, which is a normal property of MCP tools. The material does not show any need for elevated system privileges or execution of commands unrelated to legal data retrieval, so caution rather than high risk is appropriate.

The available material does not specify which local files, databases, or user resources it may read or write, so the data access boundary is not fully transparent. There is no explicit request for broad filesystem permissions or data collection beyond its stated purpose, but the actual access scope should still be verified before use.

It comes from an official registry and has a public open-source repository with updates within the last year, which are strong risk-reducing signals. Although it has little community adoption and no declared license, there is no sign of a closed-source package, unclear distribution channel, or abandonment.