# Pauhu EU Data (remote · api.pauhu.eu)

Cited search (free daily allowance), citation checks, translation; EU data sets on annual licence

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- remote · `api.pauhu.eu`: 69/100 (this document), [markdown](https://verifymcp.io/servers/eu-pauhu-data/api.md), [page](https://verifymcp.io/servers/eu-pauhu-data/api)

## Channel facts

- Endpoint: `https://api.pauhu.eu/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (monitor_delete_connector).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4887 tokens (~122/item across 40 items; 21 tools + 19 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 85% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Pauhu EU Data MCP server?

Pauhu EU Data is a hosted endpoint at https://api.pauhu.eu/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http eu-pauhu-data 'https://api.pauhu.eu/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "eu-pauhu-data": {
      "url": "https://api.pauhu.eu/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "eu-pauhu-data": {
      "type": "http",
      "url": "https://api.pauhu.eu/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.eu-pauhu-data]
url = "https://api.pauhu.eu/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eu-pauhu-data": {
      "type": "remote",
      "url": "https://api.pauhu.eu/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add eu-pauhu-data --url 'https://api.pauhu.eu/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  eu-pauhu-data:
    url: "https://api.pauhu.eu/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "eu-pauhu-data": {
      "Transport": "http",
      "Url": "https://api.pauhu.eu/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add eu-pauhu-data -t streamable-http -u 'https://api.pauhu.eu/mcp'
```

### Other

```json
{
  "mcpServers": {
    "eu-pauhu-data": {
      "type": "http",
      "url": "https://api.pauhu.eu/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-21 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 67, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-19 (score 67)

First indexed and scored.

## MCP tools (21)

### `pauhu_products` (~253 tokens)

Pauhu products: catalogue and current access state

List all 14 Pauhu sectoral products with their launch state, coverage state, and the current access flag (`entitled`: true|false per row); access does not mean a product is sellable. IMPORTANT: `live_row_count` is a fast estimate of the shared source data, NOT the product's own filtered slice -- read `row_count_basis`/`row_count_note` beside it, and use `corpus_state` and `launch_state` as the coverage signals. A product may be entitled and still not be served yet. Data from this service is sold as the pauhu.eu bulk annual plan; nothing is sold per call here, and cited answers are at https://pauhu.ai. Search is never billed. Customer's AI client calls this once at session start to learn product and access state. Pass product_id for one product's full served row: what one delivered unit is per source (unit_definition), where its rows come from (provenance), its sectoral data space (sectoral_ds), licence, cadence, limitations.

Input parameters:

- `product_id` (string): Product id from the list, e.g. pauhu-energy-eu; omit for the list of all products

### `pauhu_translate` (~124 tokens)

Pauhu translate: authoritative EU terminology

Look up EU-canonical terms across 24 official EU languages in the EU's authoritative terminology record. Returns the authoritative EU term, domain, reliability rating, and equivalents in your target language. Accepts single terms or multi-word phrases. Used for professional translation and interpretation, using domain terminology sourced from the EU's own authoritative record.

Input parameters:

- `lang` (string): Source language of the term
- `target_lang` (string): Target language for the returned equivalent term
- `term` (string, required): Term or phrase to look up (in any of the 24 EU languages)

### `monitor_register_connector` (~313 tokens)

Monitor: register a connector (your API or MCP)

Register one of your APIs or MCP servers as a connector, so your sourced monitors can watch it. Inputs: id (unique within your account), kind ('mcp' for an MCP server, 'https_json' for an HTTPS endpoint answering JSON with url plus text, paragraph_text or title, 'pauhu_sources' for the Pauhu sources your plan covers), endpoint_url, label, auth_kind ('bearer' with the name of your stored token, or 'none' for a public endpoint), and optionally mcp_tool_name (default 'search') and poll_fallback_secs. Returns the registered connector. Monitor runs over your connectors carry no per-run token charge.

Input parameters:

- `auth_kind` (string): 'bearer' (with the name of your stored token) or 'none' for a public endpoint
- `endpoint_url` (string, required): Your endpoint URL (HTTPS JSON endpoint or MCP server URL)
- `id` (string, required): Unique connector id within your account
- `kind` (string, required): Connector kind: 'mcp', 'https_json' or 'pauhu_sources'
- `label` (string, required): Human-readable label shown in your connector list
- `mcp_tool_name` (string): MCP tool to invoke (for kind=mcp; defaults to 'search')
- `poll_fallback_secs` (integer): Optional poll cadence (seconds) for sources without push semantics
- `token_ref` (string): Name of the bearer token you stored with Pauhu (for auth_kind=bearer)

### `monitor_list_connectors` (~18 tokens)

Monitor: list your registered connectors

List the connectors registered under your account.

### `monitor_delete_connector` (~34 tokens)

Monitor: delete one of your connectors

Delete a registered connector by id (tenant-scoped, you can only delete your own).

Input parameters:

- `id` (string, required)

### `monitor_register_template` (~223 tokens)

Monitor: register an interest template (what to watch + push)

Register a sourced monitor and get back the registered template. Each match is delivered to you as a cited result: the source URL, the paragraph text and a verification status. Inputs: id, connector_ids (your registered connectors to watch), query, optional jurisdiction and language filters, when to push (every_match, new_since_last, or delta_at_least with a count) and where to push (a webhook URL with an optional secret reference, or sse for an open MCP session).

Input parameters:

- `connector_ids` (array, required): Connectors to watch (your registered ids)
- `id` (string, required)
- `jurisdiction` (string): ISO 3166-1 alpha-2 or 'eu'
- `language` (string): ISO 639-1
- `push_kind` (string)
- `query` (string, required): The query / saved-search this monitor stands for
- `threshold_kind` (string)
- `threshold_n` (integer): For delta_at_least
- `webhook_secret_ref` (string)
- `webhook_url` (string)

### `monitor_list_templates` (~18 tokens)

Monitor: list your interest templates

List the interest templates registered under your account.

### `monitor_delete_template` (~28 tokens)

Monitor: delete one of your interest templates

Delete a registered interest template by id (tenant-scoped).

Input parameters:

- `id` (string, required)

### `pauhu_tm` (~176 tokens)

Pauhu TM: aligned-segment lookup for CAT workflows

Look up a text segment in Pauhu TM: aligned human-translated paragraphs from primary EU law sources. Returns the best exact or fuzzy match (gamma score 0.0-1.0) + EU terminology for the segment. Each match traces to a real paragraph URL in the original source document. Designed for CAT tool integration: pass a segment, receive the TM match + terms as a sourced CAT assist.

Input parameters:

- `domain` (string): Optional domain hint for terminology disambiguation (e.g. 'data protection', 'financial', 'environmental')
- `source_lang` (string): Source language code (e.g. 'en', 'fi', 'de', 'sv', 'fr')
- `target_lang` (string): Target language code
- `text` (string, required): Text segment to look up in the TM

### `pauhu_search` (~59 tokens)

Pauhu sourced search

Search Pauhu's curated, sourced corpus. Returns sourced passages and per-match snippets, and every answer either traces to a source or says plainly when nothing matches.

Input parameters:

- `limit` (integer): Max matches
- `q` (string, required): Search query

### `concept_crosswalk` (~163 tokens)

Concept cross-reference across EU/global authority id-spaces

Cross-reference one concept across EU and global authority id-spaces as aligned facets. Resolves the term to its concept anchor and emits a uniform list of facets: identifier CURIEs and language-tagged rendering literals ("label"@lang), each keyed by the shared concept, carrying one align verdict: exact (cited at its authority origin), frontier (no attested edge), or unresolved (transient outage, not 'no edge'). An exact identifier facet carries an IRI where its authority publishes one.

Input parameters:

- `lang` (string): Source language code e.g. 'en', 'fi', 'de' (optional)
- `term` (string, required): Concept to cross-reference (any EU language), e.g. 'personal data', 'henkilötieto'

### `source_search` (~136 tokens)

Source search (agentic resource discovery)

Search Pauhu's sourced index and get cited results as JSON. Input: q (query) and limit. Returns answer, results (id, title, url) and caller_verifies, a verification status: when true, open the cited text before relying on it. For one result's citation link, call source_fetch_fragment with the same q and limit and the result id. A citation shows where the text is quoted from, not that the source's claim is true or current; a general web publisher is one account, not established fact.

Input parameters:

- `limit` (integer): Max candidates
- `q` (string, required): Natural-language query

### `source_fetch_fragment` (~193 tokens)

Fetch one cited source fragment

Get one cited result from source_search. Input: the q and limit you passed to source_search and a result id. Returns source_url, text_fragment_url (a link that opens the quoted text), caller_verifies (a verification status: when true, open the link before relying on the text) and bearing, a proof token to pass unchanged to source_verify_bearing, or null. If the results have changed since your search, the call says so; run source_search again. A citation shows where the text is quoted from, not that the source's claim is true; a general web publisher is one account, not established fact.

Input parameters:

- `id` (string, required): The result id from source_search's results[] (a plain non-negative integer string)
- `limit` (integer, required): The exact limit value used in the originating source_search call
- `q` (string, required): The exact query string used in source_search

### `source_status` (~30 tokens)

Pauhu source resource liveness

Lightweight liveness check for this resource. Returns { ok, status } with status ok, degraded or unavailable.

### `source_verify_bearing` (~80 tokens)

Check a cited fragment's proof

Checks the bearing returned by source_fetch_fragment. Input: bearing, exactly as source_fetch_fragment returned it, and optionally the result id. Returns verified (true or false) and the id.

Input parameters:

- `bearing` (required): The bearing value from source_fetch_fragment, unchanged
- `id` (string): The result id from source_fetch_fragment (echoed back)

### `code_read` (~383 tokens)

Read a source file at an exact commit or package version

Reads one file of a public GitHub repository or npm package straight from the origin, at an exact identity: a branch or tag is resolved to its commit sha first, and an npm tarball must match the registry's sha512. Returns the requested lines with the commit (or version and integrity), the path, the git blob id of the whole file and a source URL, so the lines can be re-read and checked. Pages by line: give start_line/end_line; next_start_line names the next page. A file that is not UTF-8 text (a NUL byte in its first 8000 bytes, or invalid UTF-8) is never shown as text: the answer is binary:true with its reason, size and blob id. Read-only; nothing is indexed or stored. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

Input parameters:

- `end_line` (integer): Last line, inclusive (default start_line + 1999)
- `package` (string): npm package name, e.g. source-map-js or @scope/name. Give this or repo.
- `path` (string, required): File path inside the repository or package, e.g. lib/index.js
- `ref` (string): Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
- `repo` (string): GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
- `start_line` (integer): First line, 1-based (default 1)
- `version` (string): npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

### `code_list` (~292 tokens)

List files of a repository or package at an exact identity

Lists the files under a path of a public GitHub repository (at a commit sha) or npm package (at a version whose tarball matched the registry's sha512), with type, size and git blob id per file. Pages with offset/limit (at most 1000 entries and about 1 MB per page; truncated:true when the byte bound ended a page); total names the full count and next_offset the next page. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

Input parameters:

- `limit` (integer): Entries per page (default 500, at most 1000)
- `offset` (integer)
- `package` (string): npm package name, e.g. source-map-js or @scope/name. Give this or repo.
- `path` (string): Directory prefix (default: the root)
- `ref` (string): Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
- `repo` (string): GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
- `version` (string): npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

### `code_grep` (~387 tokens)

Search source text at an exact identity

Finds a literal string (no regular expressions) in the text files of a public GitHub repository at a commit sha or an npm package version, and returns the matches with path, line number, line text and the file's git blob id. A hit is a proven match in the exact bytes named. Counts of files scanned, binary files (a NUL byte or invalid UTF-8; never searched as text) and files over the per-file memory bound are reported, so nothing is silently left out. Pages with offset/limit: at most 1000 matches and about 1 MB per page (truncated:true when the byte bound ended a page); next_offset names the next page. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

Input parameters:

- `extensions` (array): Only files ending in one of these, e.g. [".ts", ".js"]
- `ignore_case` (boolean)
- `limit` (integer): Matches per page (default 200, at most 1000)
- `offset` (integer)
- `package` (string): npm package name, e.g. source-map-js or @scope/name. Give this or repo.
- `path` (string): Only files under this directory prefix
- `query` (string, required): Literal text to find
- `ref` (string): Branch, tag or 40-hex commit sha (default HEAD). It is resolved to a commit sha first; the read is at that sha.
- `repo` (string): GitHub repository as owner/name, e.g. nodejs/node. Give this or package.
- `version` (string): npm version or dist-tag (default latest); the tarball is checked against the registry's sha512 integrity.

### `code_diff` (~391 tokens)

Diff two commits or two package versions

Compares two exact identities of the same public GitHub repository (base and head refs, both resolved to commit shas) or npm package (base and head versions, both tarballs checked against the registry's sha512). Without path: the added, removed and changed files, decided by git blob id. With path: a unified diff of that file (Myers; minimal:false marks a large change answered as one replace hunk); identical blobs answer no hunks, a file that is not UTF-8 text answers binary:true with both blob ids and no hunks ("Binary files differ"), and a change region of more than 100000 lines is refused (diff_too_large). Pages with offset/limit (at most 1000 items and about 1 MB per page; truncated:true when the byte bound ended a page). A hunk larger than a page is split at line boundaries into consecutive hunks that apply in order; a single line larger than a page is refused (response_too_large) with both blob ids. Every answer, an error included, carries a pauhu-library-receipt/2 in structuredContent.receipt and as a trailing "receipt: {...}" text line; library_verify checks a receipt.

Input parameters:

- `base` (string, required): Base ref (repo) or version (package)
- `head` (string, required): Head ref (repo) or version (package)
- `limit` (integer): Files (summary) or hunks (path) per page (default 200, at most 1000)
- `offset` (integer)
- `package` (string): npm package name, e.g. source-map-js or @scope/name. Give this or repo.
- `path` (string): One file: answer its unified diff
- `repo` (string): GitHub repository as owner/name, e.g. nodejs/node. Give this or package.

### `library_catalogue` (~76 tokens)

Library catalogue: what the code tools answer

Lists what the code tools answer: for each, its id@version, the tool to call and the input it takes. Every code_* answer carries a receipt (format pauhu-library-receipt/2); pass it to library_verify to learn whether this service issued it and it is unchanged. Read-only; takes no input.

### `library_verify` (~177 tokens)

Check a code answer's receipt

Pass the receipt from any code_* answer and learn whether this service issued it and it is unchanged. Answers {verified, reason, id}: verified true or false; reason null, or one of bad_shape (not a receipt, or malformed), unknown_block (an id@version these tools do not answer), not_ours (not issued by this service), altered (changed after it was issued), unavailable (cannot be checked right now; retry later) or self_check_failed; id is the receipt id. With no input, runs the code tools' self-check and answers verified true or false. Read-only.

Input parameters:

- `receipt`: The receipt from a code_* answer (its structuredContent.receipt, or the JSON after "receipt: "); an object with a receipt key is unwrapped once. Omit it to run the self-check.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/eu-pauhu-data/api#diagnostics

## Score history

- 2026-10-23: 69
- 2026-10-22: 68
- 2026-10-21: 68
- 2026-10-20: 67
- 2026-10-19: 67

## Common questions

### What is the Pauhu EU Data MCP server?

Pauhu EU Data is an MCP server listed in the public MCP registry as eu.pauhu/data. Cited search (free daily allowance), citation checks, translation; EU data sets on annual licence. This page covers its hosted endpoint (https://api.pauhu.eu/mcp).

### Is the Pauhu EU Data MCP server safe to use?

Pauhu EU Data scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Pauhu EU Data MCP server expose?

Pauhu EU Data exposes 21 tools: pauhu_products, pauhu_translate, monitor_register_connector, monitor_list_connectors, monitor_delete_connector, and 16 more. Their descriptions and schemas cost roughly 3,554 tokens of context every time the server is loaded.

### Does the Pauhu EU Data MCP server require authentication?

No. We connected to Pauhu EU Data without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Pauhu EU Data MCP server still maintained?

Pauhu EU Data is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.pauhu.eu/mcp
- Website: https://pauhu.eu/?r=3ad837
- Changelog RSS feed: https://verifymcp.io/servers/eu-pauhu-data/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/eu-pauhu-data/api.json
- HTML version of this page: https://verifymcp.io/servers/eu-pauhu-data/api