B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Web & browsing, Cloud & infrastructure
korean-law-mcp
법제처 국가법령정보를 LLM에서 바로 조회하는 MCP 서버. 법령·판례·조례 검색과 인용 검증 | MCP server for Korean law — search statutes, precedents, and ordinances, and verify citations
Bottom line: Signal-based grade (5/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 68/100
- Rank
- #18 of 500
- GitHub stars
- 2.7k
- Weekly downloads
- 4k
What it does
korean-law-mcp is an MCP server that connects LLMs directly to South Korea's National Legal Information System (법제처), enabling real-time searches of statutes, precedents, and ordinances. It also supports citation verification against authoritative Korean legal sources.
Who it’s for
Legal professionals, compliance teams, and builders in South Korea or those serving Korean markets who need accurate, up-to-date legal reference within AI workflows. Organizations requiring Korean law research automation and citation validation.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
npm install korean-law-mcp
For Claude Desktop, add to your claude_desktop_config.json:
{
"mcpServers": {
"korean-law": {
"command": "npx",
"args": ["korean-law-mcp"]
}
}
}
verify against the repo README at https://github.com/chrisryugj/korean-law-mcp (opens external site) for environment variables or authentication requirements for the Korean legal database.
Risks
- Public data source risk: The connector queries a government legal database; ensure your use case complies with Korean terms of service and data regulations (e.g., PIPA for personal data in case law).
- Prompt injection: Malformed legal queries or citation data from the upstream source could be manipulated; validate structured outputs before acting on them.
- Citation accuracy: The tool performs citation verification but does not guarantee legal accuracy; misreliance on automated citation checks without human review could introduce compliance errors.
- Rate limiting & availability: Dependence on an external government API means outages or rate limits could disrupt legal workflows; consider fallback procedures.
- Supply-chain dependency: Relies on upstream maintainer and government database stability; no evidence of formal SLA or support model.
How to stay secure
Least-privilege permissions
- Grant the MCP connector read-only access to the Korean legal database API; disable any write, update, or administrative capabilities.
- Restrict connector invocation to authorized LLM workflows only; implement role-based access control (RBAC) so legal research queries are only available to compliance, legal, or designated teams.
- Limit data export scope—disable bulk download or caching of entire statutes/precedents; queries should return only result subsets needed for immediate use.
- Disable or audit any credential storage; rotate API keys regularly and use short-lived tokens if the upstream service supports them.
Network isolation
- Route all korean-law-mcp queries through a dedicated, monitored egress proxy that logs requests and validates response integrity before returning to the LLM.
- Implement network allowlisting: only permit outbound connections to official Korean government legal database endpoints (e.g., verified IP ranges or DNS names); reject all other domains.
- Use VPC/private network segments for the connector if deployed on-premise; prevent lateral movement by isolating it from systems handling sensitive client data or confidential legal work-product.
- Enforce TLS 1.2+ for all API calls; validate SSL certificates and pin known government database certificate authorities to detect man-in-the-middle attacks.
Monitoring
- Log all queries and responses (excluding full case text to minimize PII exposure); audit logs should record user, query terms, timestamp, and result counts.
- Alert on rate limit violations, API errors (5xx), or unexpected response structures; set thresholds to detect both DoS attacks and upstream outages.
- Track citation verification results separately; flag queries where the tool validates citations but results are older than 6 months or marked as deprecated/amended.
- Monitor for prompt injection patterns (e.g., SQL-like syntax, malformed JSON in citations, URLs embedded in case names); reject or escalate suspicious inputs.
Red flags to watch for
- Responses containing personally identifiable information (PII) from case law; pause processing and trigger human review to ensure PIPA compliance before any downstream use.
- Citation data that contradicts known, recent amendments or precedent overrules; do not rely solely on automated verification—cross-check critical citations manually.
- Repeated API 429 (rate limit) or 503 (service unavailable) errors; implement graceful degradation and alert teams that legal queries may be unreliable until service recovers.
- Malformed or inconsistent JSON structures in citation objects; reject and log; do not attempt to parse or correct upstream data automatically, as this may mask data tampering or API compromise.
Alternatives
- LexisNexis/Westlaw Korean modules — commercial legal research platforms with managed uptime and lawyer support, but higher cost.
- Local Korean law document indexing — self-hosted RAG using downloaded Korean statutes and precedents (e.g., via Pinecone, Weaviate) for offline compliance research.
- Korean Bar Association APIs — if available, official attorney-facing legal databases with stronger authentication and compliance controls.
- Generic legal search MCPs — broader tools (e.g., general legal MCP connectors) that may support Korean sources but with less specialized handling.