# StackLégal

> GDPR provider fiches and a static cookie scan before consent.

- name: eu.stacklegal/catalog
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 81/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/eu.stacklegal%2Fcatalog
- tools: https://api.protogrid.dev/v1/servers/eu.stacklegal%2Fcatalog/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "catalog": {
      "type": "http",
      "url": "https://stacklegal.eu/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-6d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 81/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: list_providers (idempotentHint); get_provider (idempotentHint); scan_site (idempotentHint)
- pass `tools.token_cost`: about 498 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 6 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 3, about 498 tokens to load them all
- tool set hash: e11e20e8945c17983d46c784fd0126bc
- tools last changed: 2026-10-19T14:14:04.368Z
- badge: [![protogrid quality](https://protogrid.dev/badge/eu.stacklegal/catalog.svg)](https://protogrid.dev/servers/eu.stacklegal/catalog)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `list_providers` changed (description)
  - before: List StackLégal provider fiches. Same payload as GET /api/v1/providers. Pass ids to request specific slugs, 73 at most, in that order. Omit ids for the full catalog. Unknown slugs are returned in unknown and the rest still succeeds. lang defaults to French.
  - after: List StackLégal provider fiches. Same payload as GET /api/v1/providers. Pass ids to request specific slugs, 81 at most, in that order. Omit ids for the full catalog. Unknown slugs are returned in unknown and the rest still succeeds. lang defaults to French.

Full history: https://api.protogrid.dev/v1/servers/eu.stacklegal%2Fcatalog/changes

## Remotes

- https://stacklegal.eu/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (3)

- `get_provider`: Look up one StackLégal provider fiche by canonical slug, alias (for example ga), or exact catalog name. Returns the same object as GET /api/v1/providers/{slug}. A name match is not a legal qualification. lang defaults to French.
- `list_providers`: List StackLégal provider fiches. Same payload as GET /api/v1/providers. Pass ids to request specific slugs, 81 at most, in that order. Omit ids for the full catalog. Unknown slugs are returned in unknown and the rest still succeeds. lang defaults to French.
- `scan_site`: Fetch one public URL once, without a consent cookie, and report trackers present on the first HTML response and Set-Cookie headers. JavaScript is not executed. Each tracker includes a provider slug when the scanner catalog maps it to a fiche, and the result links to the StackLégal scanner page. This is not a legal qualification. The address and the caller IP are not stored. Limited to a few scans per 10 minutes.