Legal Research MCP MVP 0.2-dev - Render Free

Render-ready read-only research MCP for the planned legal-tax-advisor-de v2.3.0 research layer.

What 0.2-dev adds

0.2-dev keeps the conservative 0.1 amendment-history contract and adds one targeted retrieval capability:

• get_official_document_text: opens an already identified official German PDF/HTML document from a strict HTTPS host allowlist, searches a locator/query, and returns page-aware evidence with content hashes.

This closes the D1 gap observed in Copilot Studio: the agent could identify Bundesrat-Drucksache 5/26 but could not open Art. 30 Nr. 1 to verify the concrete amendment command.

Related MCP server: de-eli-mcp

Tools

search_primary_sources

Controlled discovery for a small validated legislation registry (KStG, EStG, AO, GewStG). Discovery only.

get_norm

Retrieves the current official consolidated provision from gesetze-im-internet.de and returns structure/evidence metadata.

trace_norm_amendments

Safe amendment-history connectivity implementation. It may expose a whole-statute amendment header as a discovery lead but deliberately remains partial/unknown until a provision-specific chain resolver is implemented.

get_official_document_text

Opens an identified official document and retrieves an exact passage.

Accepted inputs:

• one of url or document_id;

• locator and/or query;

• optional max_passages and context_chars.

Supported document-id shortcuts:

• BR-Drs. 5/26 -> Bundesrat document server PDF;

• BT-Drs. 21/3343 -> Bundestag document server PDF;

• BGBl. 2026 I Nr. 33 -> official recht.bund.de promulgation page.

Example amendment verification target:

get_official_document_text(
  document_id="BR-Drs. 5/26",
  locator="Artikel 30",
  query="§ 8b Absatz 6 Satz 2"
)

A successful normalized query match returns coverage_status=complete and full_checked passage evidence. A locator-only result is navigation evidence and must not be treated as proof of the requested amendment phrase.

SSRF / download safety

get_official_document_text is deliberately constrained:

• HTTPS only;

• exact official-host allowlist;

• every redirect hop is revalidated;

• credentials and non-standard ports are rejected;

• download size capped at 20 MB;

• PDF text extraction only, no JavaScript/browser execution;

• read-only requests only.

Current allowlisted families include the official Bundestag/Bundesrat document server, recht.bund.de, gesetze-im-internet.de, Bundestag/Bundesrat web hosts, and the Federal Ministry of Finance website.

Render deployment

Use the included render.yaml Blueprint. The service remains configured as:

• Web Service;

• Docker runtime;

• Free plan;

• Frankfurt region;

• /health health check;

• dynamic binding to Render's PORT;

• MCP endpoint at /mcp;

• explicit Host allowlisting from RENDER_EXTERNAL_HOSTNAME.

Detailed steps: docs/render-free-deploy.md.

Local setup

python -m venv .venv
source .venv/bin/activate
pip install -r requirements-dev.txt
python -m pytest -q
uvicorn app:app --reload --port 8080

Local endpoints:

• Health: http://localhost:8080/health

• MCP: http://localhost:8080/mcp

Still not implemented

• historical statutory version resolver;

• complete provision-specific amendment-chain resolver;

• automatic discovery of every Bundesgesetzblatt/Bundestag/Bundesrat document;

• case-law retrieval;

• comprehensive BMF guidance retrieval;

• production authentication.

DEV security boundary

The Render Free deployment remains intentionally unauthenticated for DEV testing. Do not publish the Copilot agent and do not send confidential client/matter facts through the endpoint.

Free Render Web Services can spin down after inactivity and are not a production target.

0.1 -> 0.2 upgrade

1. Replace the repository files with this package and commit/push to the branch Render deploys.

2. Wait for the Render deployment to become Live.

3. Verify /health returns version 0.2.0-dev.

4. In Copilot Studio, open the existing Legal Research DE MCP server configuration and verify that get_official_document_text is exposed/enabled.

5. Run the D1 amendment retrieval test and inspect Activity Trace.

See docs/render-free-deploy.md for the detailed upgrade/test sequence.