datagouv-mcp
Official data.gouv.fr Model Context Protocol (MCP) server that allows AI chatbots to search, explore, and analyze datasets from the French national Open Data platform, directly through conversation.
No outside reports on file
Since this tool accesses public French government data, the main risks are unintended data exposure, prompt injection through dataset metadata, and potential misuse if someone uploads false data to the platform.
Based on public adoption and transparency signals as of Oct 20, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (datagouv/datagouv-mcp)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/datagouv/datagouv-mcp ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-20.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Datagouv MCP
This is an official connector that lets AI chatbots search and analyze datasets from data.gouv.fr, France's national open data platform. Users can ask questions about French government data directly in conversation, and the tool retrieves and explores relevant datasets without leaving the chat.
Who it’s for
People and organizations in France (or those studying French data) who want AI assistants to help find and understand public French government datasets. Journalists, researchers, and data analysts may find it useful.
Alternatives
- Kaggle MCP connector (if available): searches public datasets from Kaggle instead of French government sources.
- Custom REST API wrapper: build your own MCP tool that queries a specific trusted data API.
- Manual data.gouv.fr browsing: use the web platform directly rather than through AI automation.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation instructions. The tool is designed as an MCP server, so setup likely involves configuring it in your AI platform's MCP settings (such as Claude Desktop's configuration file).
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.6k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Data exposure: The tool can retrieve any public dataset from data.gouv.fr, so queries may accidentally expose sensitive-looking information that's technically public but unintended for your use case.
- Prompt injection: Malicious dataset titles or descriptions scraped from the platform could trick the AI into unexpected behavior if not sanitized properly.
- Query logging: Your search queries and the data retrieved may be logged or cached, potentially exposing what information you're interested in.
- Authority impersonation: An attacker could upload misleading datasets to the platform (if permissions allow) to make the AI return false information about French government data.
- Rate limiting and abuse: Heavy use could trigger rate limits, blocking legitimate requests.
How to lower the risk
Least-privilege permissions
- Run the connector with minimal API access to data.gouv.fr.
- Restrict which datasets the AI is allowed to query if possible.
Network isolation
- Use a firewall to limit outbound connections to only data.gouv.fr endpoints.
- Run the connector on a dedicated, isolated machine if handling sensitive queries.
Monitoring
- Log all dataset queries and results for audit purposes.
- Alert on unusual query patterns or rate-limit errors.
Red flags to watch for
- Queries returning suspicious or out-of-context data suggesting injection attacks.
- Unexpected rate-limit warnings indicating possible abuse.
- Responses mentioning datasets with misleading or harmful descriptions.
Questions
How do I install Datagouv MCP?
Datagouv MCP does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/datagouv/datagouv-mcp.
Are there security reports about Datagouv MCP?
No reports found for this package in our research (last checked 2026-10-30). Datagouv MCP currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include data exposure, prompt injection, query logging.
Is Datagouv MCP actively maintained?
Datagouv MCP has 1.6k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/datagouv/datagouv-mcp before pinning it in production.
What are alternatives to Datagouv MCP?
Notable alternatives to Datagouv MCP include Kaggle MCP connector, Custom REST API wrapper (build your own MCP tool that queries a specific trusted data API), Manual data.gouv.fr browsing (use the web platform directly rather than through AI automation). You can also compare Datagouv MCP side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Datagouv MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/datagouv-datagouv-mcp)HTML embed:
<a href="https://agentarmorhq.com/skills/datagouv-datagouv-mcp"><img src="https://agentarmorhq.com/api/badge/datagouv-datagouv-mcp" alt="AgentArmorHQ Risk Grade for Datagouv MCP" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "datagouv-datagouv-mcp"Share with your security lead
Need sign-off to use datagouv-mcp? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: datagouv-mcp
- **Listing URL:** https://agentarmorhq.com/skills/datagouv-datagouv-mcp
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.6k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** GitHub (datagouv/datagouv-mcp)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/datagouv/datagouv-mcp
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 20, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- datagouv
- Source code
- github.com/datagouv/datagouv-mcp
- Est. context load
- ~900 tokens / turn (~5 tool schemas, 0.45% of 200k context)
- Popularity
- 1.6k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-20
Community
Discussions for Datagouv MCP
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude