io.github.malkreide/openlex-mcp

The materials explicitly state that no keys or environment variables are required, and there is no indication that API tokens, account credentials, or other sensitive secrets are needed, so credential exposure and abuse risk appears low.

The description indicates it works with ZH-Lex legislation data for full-text search and article extraction, which commonly implies access to a corresponding legislation data source. Although no remote endpoint is declared and there is no evidence of exfiltration to unrelated third parties, the materials do not provide enough detail on network behavior, so actual destinations and transmitted content should be verified.

The objective checks mark this tool as executes-code, meaning it runs code/processes locally. This is a normal MCP tool capability; the provided materials do not show requests for system privileges beyond its stated purpose, but it should still be run in a constrained environment.

The materials do not specify exactly which local files or data resources it can read or write. As a locally executed MCP tool, it may naturally access session inputs and its runtime directory, but there is no evidence here that it requires broad filesystem privileges or clearly overreaching access.

It comes from an official registry and has a public source repository with updates within the last year, providing auditability and some maintenance signals. Low star count and an unspecified license add some uncertainty, but not enough to constitute a high-risk supply-chain red flag.