io.github.CSOAI-ORG/eu-ai-act-compliance-mcp

One-sentence AI system description -> instant EU AI Act risk classification and top obligations. No API key required. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

All EU AI Act enforcement deadlines with days remaining. No parameters needed. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Classify an AI system's risk level under the EU AI Act. Takes a description of an AI system and returns its risk classification: prohibited, high-risk, limited-risk, or minimal-risk — per Article 5 (prohibited practices), Article 6 + Annex III (high-risk), Articles 50/52 (limited risk: transparency obligations), or minimal risk. Includes all 8 Annex III high-risk areas and all Article 5 prohibited practices. Args: description: A description of the AI system, its purpose, data used, and deployment context. system_name: Optional. Name/title of the AI system (e.g. consistent with check_compliance/generate_documentation). If provided and description is empty, the system name is used as the description. caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

List all regulations currently in the EUR-Lex FTS5 database with article counts and last-sync date.

Run an EU AI Act compliance check against Articles 9-15 requirements. Takes system details and current compliance posture, returns a detailed checklist with pass/fail/unknown for each requirement under Articles 9-15 (the core obligations for high-risk AI systems). Args: system_name: Name of the AI system being assessed. purpose: Description of the system's intended purpose and use context. data_types: Types of data processed (e.g., "personal data, biometric data, health records"). decision_scope: What decisions the system makes or assists with (e.g., "loan approvals, hiring recommendations"). has_risk_management: Whether a documented risk management system exists (Article 9). has_data_governance: Whether data governance practices are in place (Article 10). has_technical_docs: Whether Annex IV technical documentation exists (Article 11). has_logging: Whether automatic event logging is implemented (Article 12). has_transparency_info: Whether transparency/instructions for use exist (Article 13). has_human_oversight: Whether human oversight measures are built in (Article 14). has_accuracy_testing: Whether accuracy, robustness, and cybersecurity are tested (Article 15). caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

COST WARNING: $0.25/call on x402-billed deployments (hosted); free when self-hosted or X402 is disabled. Generate Article 11 / Annex IV compliant technical documentation template. Produces a complete markdown template following the Annex IV structure of the EU AI Act. Fill in the bracketed sections with your specific information. Args: system_name: Name of the AI system. provider_name: Legal name of the AI system provider. provider_contact: Provider contact details (address, email, phone). version: System version number/identifier. intended_purpose: Clear description of the system's intended purpose. description: General description of what the system does. data_description: Description of training/validation/testing data used. architecture_description: Description of system architecture and algorithms. performance_metrics: Known accuracy/performance metrics (if available). risk_management_description: Description of risk management measures (if available). human_oversight_description: Description of human oversight measures (if available). caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

COST WARNING: $0.10/call on x402-billed deployments (hosted); free when self-hosted or X402 is disabled. Calculate potential EU AI Act penalties for a given violation type. Returns the applicable fine range per Article 99, considering company size and the type of violation (prohibited practices, high-risk non-compliance, or providing incorrect information). Args: violation_type: Type of violation — one of "prohibited" (Article 5 violations), "high_risk_obligations" (Articles 9-15 and other requirements), or "incorrect_information" (misleading info to authorities). annual_global_turnover_eur: Company's annual global turnover in EUR. Used to calculate turnover-based penalties. is_sme: Whether the company qualifies as an SME (Small/Medium Enterprise). SMEs and startups may benefit from proportionate penalties per Article 99(6). caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Get key EU AI Act implementation dates and deadlines. Returns all major enforcement milestones from entry into force through full implementation, including which articles/requirements become applicable at each date. Args: caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Full-text search across 410 articles of real EU regulation text (EUR-Lex verified). Args: query: Search terms. Supports FTS5 syntax (AND, OR, NEAR, phrase quoting). regulation: Optional filter — one of: eu-ai-act, dora, nis2, cra, csrd, gdpr. limit: Max results to return (default 10). Returns: Dict with snippets from matching articles, each annotated with regulation, article number, and a relevance score. Snippets are 64-token windows with `>>>match<<<` highlight markers around the matched terms. Behavior: Verbatim text from EUR-Lex Cellar (Regulation EU 2024/1689, EU 2022/2554, EU 2022/2555, EU 2024/2847, EU 2022/2464, EU 2016/679). Updated daily via GitHub Actions sync from publications.europa.eu SPARQL endpoint. No LLM summarization — every quote is auditor-defensible.

COST WARNING: $0.50/call on x402-billed deployments (hosted); free when self-hosted or X402 is disabled. Generate a complete EU AI Act audit report. Runs classification, compliance check, documentation generation, and penalty assessment — then combines everything into a comprehensive markdown audit report. This is the all-in-one tool for compliance officers. Args: system_name: Name of the AI system. provider_name: Legal name of the AI system provider. provider_contact: Provider contact details. version: System version number. purpose: System's intended purpose and use context. description: General description of the system. data_types: Types of data processed. decision_scope: What decisions the system makes or assists with. architecture_description: Description of system architecture. has_risk_management: Whether risk management system exists. has_data_governance: Whether data governance practices exist. has_technical_docs: Whether technical documentation exists. has_logging: Whether automatic logging is implemented. has_transparency_info: Whether transparency info exists. has_human_oversight: Whether human oversight measures exist. has_accuracy_testing: Whether accuracy/robustness testing is done. annual_global_turnover_eur: Annual global turnover in EUR. is_sme: Whether the company is an SME. caller: Identifier for rate limiting. tier: "free" (10 calls/day) or "pro" (unlimited, $29/mo). Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

COST WARNING: $0.10/call on x402-billed deployments (hosted); free when self-hosted or X402 is disabled. Map EU AI Act articles to equivalent requirements in UK, Singapore, Canada, and US NIST. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Neural network-based risk prediction that improves from every compliance check. Predicts overall risk, violation probability, remediation urgency, and audit priority. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Get aggregate learning insights from the neural compliance model — training history, maturity, and common risk patterns. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Return the full verbatim text of one article from EUR-Lex, with canonical URL. Args: regulation: One of eu-ai-act, dora, nis2, cra, csrd, gdpr. article_number: Article number (e.g. 33 for GDPR personal data breach notification). Returns: Dict with regulation, celex, article_number, content (full verbatim text), content_length, eur_lex_url. Drop straight into audit evidence packs — every character comes from publications.europa.eu Cellar. Behavior: Read-only, stateless, idempotent. Free tier: 10/day. PAYG: £0.05/call. Pro: unlimited.

COST WARNING: $0.10/call on x402-billed deployments (hosted); free when self-hosted or X402 is disabled. Map ISO/IEC 42001 (AI Management System) clauses to EU AI Act articles, with evidence reuse hints. Args: clause: Optional ISO 42001 clause (4-10) to focus on. Empty = full crosswalk. article: Optional EU AI Act article number to look up in reverse. api_key: Optional MEOK API key (Pro tier gets the signed evidence pack). Returns: Either the full crosswalk or the filtered subset, plus a recommendation for which ISO 42001 audit artefact maps to which AI Act obligation. Auditor-defensible: each row cites the canonical AIMS control + AI Act article. Behavior: Read-only, stateless, idempotent. Free tier: 10/day. PAYG: £0.05/call. Pro: unlimited.

Citation graph for one article — what it cites + who cites it. Args: regulation: One of eu-ai-act, dora, nis2, cra, csrd, gdpr. article_number: Article number (e.g. 33 for GDPR personal-data breach notification). Returns: outbound_citations: articles this one cites. inbound_citations: articles across the full 6-regulation corpus that cite this one. Each carries a snippet of the citing context so auditors see the reference. Example: cross_references_for_article("gdpr", 33) reveals that GDPR Article 33 (personal data breach notification) is cited by NIS2 Article 35 and EU AI Act Article 59 — a one-call view of the multi-regulation evidence trail. Behavior: Read-only. Idempotent. Free tier: 10/day. PAYG: £0.05/call. Pro: unlimited.