Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Pauhu EU Data

REMOTE · API.PAUHU.EU

Cited search (free daily allowance), citation checks, translation; EU data sets on annual licence

Available components

69 Trust /100

Last scanned (3 hours ago)

Scores higher than 59% of remote servers

Reachable. Last reached 23 Oct 2026.

Category Search and Retrieval

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4887 tokens (~122/item across 40 items; 21 tools + 19 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
  • Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 85% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Oct 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 19 Oct 26 67

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 23 Oct 2026 · Probed https://api.pauhu.eu/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=api.pauhu.eu CN=YE2,O=Let's Encrypt,C=US 7 Oct 2026 5 Jan 2027 ECDSA 256 ECDSA-SHA384 62102be380edee64b81f466077b5b8bd731
SANs: api.pauhu.eu
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of api.pauhu.eu. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
eu. present 35926 8 Verified
pauhu.eu. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy camera=(), microphone=(), geolocation=()

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.pauhu.eu/mcp Verified 200
http (plaintext) http://api.pauhu.eu/mcp HTTPS enforced 308 https://api.pauhu.eu/mcp
MCP tools · 21 exposed · ~3,554 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
code_diff ~391

Compares two exact identities of the same public GitHub repository (base and head refs, both resolved to commit shas) or npm package (base and head versions, both tarballs checked against the registry's sha512). Without path: the added, removed and changed files, decided by git blob id. With path: a unified diff of that file (Myers; minimal:false marks a large change answered as one replace hunk); identical blobs answer no hunks, a file that is not UTF-8 text answers binary:true with both blob ids and no hunks ("Binary files differ"), and a change region of more than 100000 lines is refused (diff_too_large). Pages with offset/limit (at most 1000 items and about 1 MB per page; truncated:true when the byte bound ended a page). A hunk larger than a page is split at line boundaries into consecutive hunks that apply in order; a single line larger than a page is refused (response_too_large) with both blob ids. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

NameTypeReqDescription
basestringyesBase ref (repo) or version (package)
headstringyesHead ref (repo) or version (package)
limitinteger–Files (summary) or hunks (path) per page (default 200, at most 1000)
offsetinteger––
packagestring–npm package name, e.g. source-map-js or @scope/name. Give this or repo.
pathstring–One file: answer its unified diff
repostring–GitHub repository as owner/name, e.g. nodejs/node. Give this or package.

No output schema declared.

No examples provided.

code_grep ~387

Finds a literal string (no regular expressions) in the text files of a public GitHub repository at a commit sha or an npm package version, and returns the matches with path, line number, line text and the file's git blob id. A hit is a proven match in the exact bytes named. Counts of files scanned, binary files (a NUL byte or invalid UTF-8; never searched as text) and files over the per-file memory bound are reported, so nothing is silently left out. Pages with offset/limit: at most 1000 matches and about 1 MB per page (truncated:true when the byte bound ended a page); next_offset names the next page. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

NameTypeReqDescription
extensionsarray–Only files ending in one of these, e.g. [".ts", ".js"]
ignore_caseboolean––
limitinteger–Matches per page (default 200, at most 1000)
offsetinteger––
packagestring–npm package name, e.g. source-map-js or @scope/name. Give this or repo.
pathstring–Only files under this directory prefix
querystringyesLiteral text to find
refstring–Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
repostring–GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
versionstring–npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

No output schema declared.

No examples provided.

code_list ~292

Lists the files under a path of a public GitHub repository (at a commit sha) or npm package (at a version whose tarball matched the registry's sha512), with type, size and git blob id per file. Pages with offset/limit (at most 1000 entries and about 1 MB per page; truncated:true when the byte bound ended a page); total names the full count and next_offset the next page. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

NameTypeReqDescription
limitinteger–Entries per page (default 500, at most 1000)
offsetinteger––
packagestring–npm package name, e.g. source-map-js or @scope/name. Give this or repo.
pathstring–Directory prefix (default: the root)
refstring–Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
repostring–GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
versionstring–npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

No output schema declared.

No examples provided.

code_read ~383

Reads one file of a public GitHub repository or npm package straight from the origin, at an exact identity: a branch or tag is resolved to its commit sha first, and an npm tarball must match the registry's sha512. Returns the requested lines with the commit (or version and integrity), the path, the git blob id of the whole file and a source URL, so the lines can be re-read and checked. Pages by line: give start_line/end_line; next_start_line names the next page. A file that is not UTF-8 text (a NUL byte in its first 8000 bytes, or invalid UTF-8) is never shown as text: the answer is binary:true with its reason, size and blob id. Read-only; nothing is indexed or stored. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

NameTypeReqDescription
end_lineinteger–Last line, inclusive (default start_line + 1999)
packagestring–npm package name, e.g. source-map-js or @scope/name. Give this or repo.
pathstringyesFile path inside the repository or package, e.g. lib/index.js
refstring–Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
repostring–GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
start_lineinteger–First line, 1-based (default 1)
versionstring–npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

No output schema declared.

No examples provided.

concept_crosswalk ~163

Cross-reference one concept across EU and global authority id-spaces as aligned facets. Resolves the term to its concept anchor and emits a uniform list of facets: identifier CURIEs and language-tagged rendering literals ("label"@lang), each keyed by the shared concept, carrying one align verdict: exact (cited at its authority origin), frontier (no attested edge), or unresolved (transient outage, not 'no edge'). An exact identifier facet carries an IRI where its authority publishes one.

NameTypeReqDescription
langstring–Source language code e.g. 'en', 'fi', 'de' (optional)
termstringyesConcept to cross-reference (any EU language), e.g. 'personal data', 'henkilötieto'

No output schema declared.

No examples provided.

library_catalogue ~76

Lists what the code tools answer: for each, its id@version, the tool to call and the input it takes. Every code_* answer carries a receipt (format pauhu-library-receipt/2); pass it to library_verify to learn whether this service issued it and it is unchanged. Read-only; takes no input.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

library_verify ~177

Pass the receipt from any code_* answer and learn whether this service issued it and it is unchanged. Answers {verified, reason, id}: verified true or false; reason null, or one of bad_shape (not a receipt, or malformed), unknown_block (an id@version these tools do not answer), not_ours (not issued by this service), altered (changed after it was issued), unavailable (cannot be checked right now; retry later) or self_check_failed; id is the receipt id. With no input, runs the code tools' self-check and answers verified true or false. Read-only.

NameTypeReqDescription
receipt––The receipt from a code_* answer (its structuredContent.receipt, or the JSON after "receipt: "); an object with a receipt key is unwrapped once. Omit it to run the self-check.

No output schema declared.

No examples provided.

monitor_delete_connector ~34

Delete a registered connector by id (tenant-scoped, you can only delete your own).

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

monitor_delete_template ~28

Delete a registered interest template by id (tenant-scoped).

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

monitor_list_connectors ~18

List the connectors registered under your account.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

monitor_list_templates ~18

List the interest templates registered under your account.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

monitor_register_connector ~313

Register one of your APIs or MCP servers as a connector, so your sourced monitors can watch it. Inputs: id (unique within your account), kind ('mcp' for an MCP server, 'https_json' for an HTTPS endpoint answering JSON with url plus text, paragraph_text or title, 'pauhu_sources' for the Pauhu sources your plan covers), endpoint_url, label, auth_kind ('bearer' with the name of your stored token, or 'none' for a public endpoint), and optionally mcp_tool_name (default 'search') and poll_fallback_secs. Returns the registered connector. Monitor runs over your connectors carry no per-run token charge.

NameTypeReqDescription
auth_kindstring–'bearer' (with the name of your stored token) or 'none' for a public endpoint
endpoint_urlstringyesYour endpoint URL (HTTPS JSON endpoint or MCP server URL)
idstringyesUnique connector id within your account
kindstringyesConnector kind: 'mcp', 'https_json' or 'pauhu_sources'
labelstringyesHuman-readable label shown in your connector list
mcp_tool_namestring–MCP tool to invoke (for kind=mcp; defaults to 'search')
poll_fallback_secsinteger–Optional poll cadence (seconds) for sources without push semantics
token_refstring–Name of the bearer token you stored with Pauhu (for auth_kind=bearer)

No output schema declared.

No examples provided.

monitor_register_template ~223

Register a sourced monitor and get back the registered template. Each match is delivered to you as a cited result: the source URL, the paragraph text and a verification status. Inputs: id, connector_ids (your registered connectors to watch), query, optional jurisdiction and language filters, when to push (every_match, new_since_last, or delta_at_least with a count) and where to push (a webhook URL with an optional secret reference, or sse for an open MCP session).

NameTypeReqDescription
connector_idsarrayyesConnectors to watch (your registered ids)
idstringyes–
jurisdictionstring–ISO 3166-1 alpha-2 or 'eu'
languagestring–ISO 639-1
push_kindstring––
querystringyesThe query / saved-search this monitor stands for
threshold_kindstring––
threshold_ninteger–For delta_at_least
webhook_secret_refstring––
webhook_urlstring––

No output schema declared.

No examples provided.

pauhu_products ~253

List all 14 Pauhu sectoral products with their launch state, coverage state, and the current access flag (`entitled`: true|false per row); access does not mean a product is sellable. IMPORTANT: `live_row_count` is a fast estimate of the shared source data, NOT the product's own filtered slice -- read `row_count_basis`/`row_count_note` beside it, and use `corpus_state` and `launch_state` as the coverage signals. A product may be entitled and still not be served yet. Data from this service is sold as the pauhu.eu bulk annual plan; nothing is sold per call here, and cited answers are at https://pauhu.ai. Search is never billed. Customer's AI client calls this once at session start to learn product and access state. Pass product_id for one product's full served row: what one delivered unit is per source (unit_definition), where its rows come from (provenance), its sectoral data space (sectoral_ds), licence, cadence, limitations.

NameTypeReqDescription
product_idstring–Product id from the list, e.g. pauhu-energy-eu; omit for the list of all products

No output schema declared.

No examples provided.

pauhu_search ~59

Search Pauhu's curated, sourced corpus. Returns sourced passages and per-match snippets, and every answer either traces to a source or says plainly when nothing matches.

NameTypeReqDescription
limitinteger–Max matches
qstringyesSearch query

No output schema declared.

No examples provided.

pauhu_tm ~176

Look up a text segment in Pauhu TM: aligned human-translated paragraphs from primary EU law sources. Returns the best exact or fuzzy match (gamma score 0.0-1.0) + EU terminology for the segment. Each match traces to a real paragraph URL in the original source document. Designed for CAT tool integration: pass a segment, receive the TM match + terms as a sourced CAT assist.

NameTypeReqDescription
domainstring–Optional domain hint for terminology disambiguation (e.g. 'data protection', 'financial', 'environmental')
source_langstring–Source language code (e.g. 'en', 'fi', 'de', 'sv', 'fr')
target_langstring–Target language code
textstringyesText segment to look up in the TM

No output schema declared.

No examples provided.

pauhu_translate ~124

Look up EU-canonical terms across 24 official EU languages in the EU's authoritative terminology record. Returns the authoritative EU term, domain, reliability rating, and equivalents in your target language. Accepts single terms or multi-word phrases. Used for professional translation and interpretation, using domain terminology sourced from the EU's own authoritative record.

NameTypeReqDescription
langstring–Source language of the term
target_langstring–Target language for the returned equivalent term
termstringyesTerm or phrase to look up (in any of the 24 EU languages)

No output schema declared.

No examples provided.

source_fetch_fragment ~193

Get one cited result from source_search. Input: the q and limit you passed to source_search and a result id. Returns source_url, text_fragment_url (a link that opens the quoted text), caller_verifies (a verification status: when true, open the link before relying on the text) and bearing, a proof token to pass unchanged to source_verify_bearing, or null. If the results have changed since your search, the call says so; run source_search again. A citation shows where the text is quoted from, not that the source's claim is true; a general web publisher is one account, not established fact.

NameTypeReqDescription
idstringyesThe result id from source_search's results[] (a plain non-negative integer string)
limitintegeryesThe exact limit value used in the originating source_search call
qstringyesThe exact query string used in source_search

No output schema declared.

No examples provided.

source_search ~136

Search Pauhu's sourced index and get cited results as JSON. Input: q (query) and limit. Returns answer, results (id, title, url) and caller_verifies, a verification status: when true, open the cited text before relying on it. For one result's citation link, call source_fetch_fragment with the same q and limit and the result id. A citation shows where the text is quoted from, not that the source's claim is true or current; a general web publisher is one account, not established fact.

NameTypeReqDescription
limitinteger–Max candidates
qstringyesNatural-language query

No output schema declared.

No examples provided.

source_status ~30

Lightweight liveness check for this resource. Returns { ok, status } with status ok, degraded or unavailable.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

source_verify_bearing ~80

Checks the bearing returned by source_fetch_fragment. Input: bearing, exactly as source_fetch_fragment returned it, and optionally the result id. Returns verified (true or false) and the id.

NameTypeReqDescription
bearing–yesThe bearing value from source_fetch_fragment, unchanged
idstring–The result id from source_fetch_fragment (echoed back)

No output schema declared.

No examples provided.

Install

How do I install the Pauhu EU Data MCP server?

Pauhu EU Data is a hosted endpoint at https://api.pauhu.eu/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · api.pauhu.eu

# add to Claude Code
claude mcp add --transport http eu-pauhu-data 'https://api.pauhu.eu/mcp'
Common questions

What is the Pauhu EU Data MCP server?

Pauhu EU Data is an MCP server listed in the public MCP registry as eu.pauhu/data. Cited search (free daily allowance), citation checks, translation; EU data sets on annual licence. This page covers its hosted endpoint (https://api.pauhu.eu/mcp).

Is the Pauhu EU Data MCP server safe to use?

Pauhu EU Data scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Pauhu EU Data MCP server expose?

Pauhu EU Data exposes 21 tools: pauhu_products, pauhu_translate, monitor_register_connector, monitor_list_connectors, monitor_delete_connector, and 16 more. Their descriptions and schemas cost roughly 3,554 tokens of context every time the server is loaded.

Does the Pauhu EU Data MCP server require authentication?

No. We connected to Pauhu EU Data without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Pauhu EU Data MCP server still maintained?

Pauhu EU Data is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.