Legal MCP (alternativa ao Jusbrasil)

The materials indicate no required keys or environment variables, and no API token, OAuth credential, or other highly sensitive local secret is requested, so the credential exposure surface appears limited. Still, if later versions add authentication, avoid mixing personal legal-query data with broader account tokens.

The tool is declared to connect to api.mcp.ai; based on its stated function, user inputs such as names, CPF, CNPJ, and case numbers will likely be sent to that remote endpoint to perform searches. This egress is consistent with the declared functionality, but it should be treated as sensitive outbound data because it may involve personal identity and litigation information.

System checks indicate that this MCP executes code and runs a local process, which is a normal operating model for MCP tools. The current materials do not show requests for unusual system privileges or high-risk actions unrelated to legal search, but it should still be run with the usual isolation controls for third-party executable code.

Based on the available materials, there is no stated need for broad local file read/write access, system-directory access, or extra resource permissions; the main data surface appears to be user-supplied legal search parameters and returned results. Because the query fields may include sensitive identity data, inputs should be minimized and unnecessary personal data should not be provided in sessions.

It comes from the official Registry and has an auditable open-source repository with updates within the past year, which are strong risk-reducing signals. While the license is undeclared and community stars are low, reducing confidence in ecosystem maturity, the available facts do not show classic supply-chain red flags such as closed-source exfiltration to unknown endpoints, abandonment, or deceptive packaging.