EUR-Lex

The materials explicitly state there are no required keys or environment variables and describe the tool as keyless. No API key, OAuth token, or local sensitive credential requirement is shown, so credential exposure risk appears low.

The tool connects to the remote endpoint gateway.pipeworx.io. As a legal retrieval MCP, user queries may be sent to that service for processing. The materials do not specify detailed data flow or privacy boundaries, but the endpoint is declared and appears related to the stated function, so this is a standard caution item.

System checks indicate it executes code or starts a local process, which is a common MCP behavior. The provided materials do not show requests for system privileges beyond what a retrieval tool would normally need, nor any suspicious commands or escalation behavior, so this is rated caution rather than risk.

The materials do not specify what local files it may read or write or what data it persists, so the data access boundary is not fully transparent. Given its MCP nature, some local data exposure should be assumed, but there is no explicit sign of overbroad access or data requests unrelated to the stated function.

It comes from an official registry source and provides an open-source repository with updates within the last year, both of which are positive signals for auditability and maintenance. Although the license is not declared and community stars are low, there are no current red flags such as closed-source unexplained exfiltration, untrusted origin, or obvious abandonment.