registry  /  korean-law-mcp  /  4.6.0

korean-law-mcp@4.6.0

법제처 42개 API → 9개 MCP 도구. 법령·판례·조례·조약 + 다단계 리서치(legal_research, 8 task) + 정밀분석(legal_analysis: 인용검증·판례생사·행위시법·영향그래프) + 시점 비교(time_travel) + 상황별 5단계 안내(action_plan) + 국세청 해석례(nts)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Runtime behavior is a Korean law MCP/CLI that uses an API key to query law data and can optionally start a local HTTP/SSE server when requested.

Static reason
No blocking static signals were detected.
Trigger
User runs korean-law-mcp, korean-law, or explicit setup/HTTP mode command.
Impact
Expected legal-data lookup functionality; no evidence of credential harvesting, persistence, destructive behavior, or unconsented install-time agent control mutation.
Mechanism
User-invoked MCP/CLI legal search client
Rationale
Source inspection of the manifest and declared bin/main entrypoints shows package-aligned MCP/CLI behavior, with environment variable use limited to API authentication. Scanner network/env findings are expected for a law API client and do not show exfiltration or install-time compromise.
Evidence
package.jsonbuild/index.jsbuild/cli.js
Network endpoints1
open.law.go.kr/LSO/openApi/guideResult.do

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no install/preinstall/postinstall hooks; prepare is husky and prepublishOnly builds only.
    • build/index.js only starts an MCP stdio server or user-selected HTTP/SSE server, and setup is explicit via args[0]==setup.
    • build/cli.js exposes user-invoked Korean law search commands and reads LAW_OC only for API authentication.
    • No import-time shell execution or lifecycle mutation found in entrypoints inspected.
    Behavioral surface
    Source
    ChildProcessEnvironmentVarsFilesystemNetwork
    Supply chain
    HighEntropyStringsUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 103 file(s), 778 KB of source, external domains: 0.0.0.0, glaw.scourt.go.kr, library.scourt.go.kr, open.law.go.kr, taxlaw.nts.go.kr, www.elis.go.kr, www.law.go.kr, www.moleg.go.kr

    Source & flagged code

    0 flagged
    No flagged code excerpts are attached to this scan.

    Findings

    2 Medium5 Low
    MediumNetwork
    MediumEnvironment Vars
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings