Double AIgents DSAR service

by www.doubleaigents.com · remote · no sign-in to list tools · v1.2.0 · published by com.doubleaigents.www

GDPR DSAR deadlines, breach triage, AI tool checks, HR retention and letters (UK/EU/CH)

Final · 1Changes · 8

Compare Registry entry

10 tools: 1 do something that can't be undone, 8 change things and 1 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone1Claude Code: ask: see these tools
Changes things8Claude Code: ask: see these tools
Only reads1Claude Code: allow: see these tools

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http dsar https://www.doubleaigents.com/api/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warndsar_request_scoping
The server marks "dsar_request_scoping" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dsar_request_scoping" says "request": a word for a change.
What this check looks for
Warnbreach_triage
The server marks "breach_triage" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.recipient): what it sends cannot be taken back.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

breach_triageA likely-reportability view on a personal data breach (UK, EU/EEA, Switzerland), following the ICO guide "Personal data breaches: a guide" and EDPB Guidelines 9/2022: whether notif…1 finding
Why it is in this group
- The input addresses people (input.recipient): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "breach_triage" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.recipient): what it sends cannot be taken back.
  What this check looks for
Description, as the server wrote it
A likely-reportability view on a personal data breach (UK, EU/EEA, Switzerland), following the ICO guide "Personal data breaches: a guide" and EDPB Guidelines 9/2022: whether notifying the regulator and telling the people affected is likely or unlikely to be required, the factors behind that view, and the notification deadline. The controller decides. General information, not legal advice. Do not pass names or other personal data.
Annotations the server declares
- title: Personal data breach triage
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Changes things 8Creates or changes something that can be changed back.Claude Code: ask

ai_tool_checkScreens a planned use of an AI tool: whether a DPIA is likely to be required (Art.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Screens a planned use of an AI tool: whether a DPIA is likely to be required (Art. 35(3), the ICO high-risk list, the WP248 criteria; FADP Art. 22 for Switzerland), EU AI Act risk flags (Annex III high-risk areas, especially employment; Art. 5 prohibited practices such as emotion recognition at work; current application dates after the Digital Omnibus), and automated decision rules (GDPR Art. 22, UK GDPR Arts 22A to 22D). Findings with sources. The use_case text is not stored or returned. General information, not legal advice.
Annotations the server declares
- title: AI tool check
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
breach_clockWhen a personal data breach must be notified to the regulator: 72 hours from awareness in the UK and EU/EEA (Art.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
When a personal data breach must be notified to the regulator: 72 hours from awareness in the UK and EU/EEA (Art. 33), "as soon as possible" in Switzerland (revised FADP Art. 24). Gives the deadline, the rule, the processor and individual-notification position, and the facts the regulator will ask for. The controller decides whether to notify. General information, not legal advice.
Annotations the server declares
- title: Personal data breach notification clock
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dsar_deadlineCalculate the statutory deadline for answering a data subject access request in the UK, the EU/EEA or Switzerland, with the rule that applies and the extension position.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Calculate the statutory deadline for answering a data subject access request in the UK, the EU/EEA or Switzerland, with the rule that applies and the extension position. General information, not legal advice.
Annotations the server declares
- title: DSAR response deadline
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dsar_letter_templatePlain-text letter template, in British English with [placeholders], for an acknowledgement, an extension of time or a request for clarification of a data subject access request, un…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Plain-text letter template, in British English with [placeholders], for an acknowledgement, an extension of time or a request for clarification of a data subject access request, under UK, EU/EEA or Swiss law. Fills in the dates if received_date is given. General information, not legal advice.
Annotations the server declares
- title: DSAR letter template
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dsar_quoteFixed price from Double AIgents for preparing a DSAR response, by pack size in pages after de-duplication.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Fixed price from Double AIgents for preparing a DSAR response, by pack size in pages after de-duplication. Also gives the retainer price (15% off). Excludes VAT.
Annotations the server declares
- title: DSAR fixed-price quote
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dsar_request_scopingExplains how to start free scoping and returns a prefilled email (mailto URL) to james@doubleaigents.com.1 finding
Why it is in this group
- The name "dsar_request_scoping" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "dsar_request_scoping" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dsar_request_scoping" says "request": a word for a change.
  What this check looks for
Description, as the server wrote it
Explains how to start free scoping and returns a prefilled email (mailto URL) to james@doubleaigents.com. Sends nothing and stores nothing. Do not pass the requester's personal data or the request letter.
Annotations the server declares
- title: Start DSAR scoping
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dsar_service_infoWhat the Double AIgents DSAR service covers: scoping, collection guidance, de-duplication, redaction, exemption recommendations, two independent reviews, secure delivery, data hand…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
What the Double AIgents DSAR service covers: scoping, collection guidance, de-duplication, redaction, exemption recommendations, two independent reviews, secure delivery, data handling, jurisdictions and partner arrangements.
Annotations the server declares
- title: DSAR service information
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
hr_retentionRecommended retention period for a common UK HR record, whether it is statutory or only recommended, and the source (HMRC, Home Office, RIDDOR 2013, Working Time Regulations, Limit…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Recommended retention period for a common UK HR record, whether it is statutory or only recommended, and the source (HMRC, Home Office, RIDDOR 2013, Working Time Regulations, Limitation Act 1980, ICO, DBS). UK only for now. General information, not legal advice.
Annotations the server declares
- title: HR record retention periods (UK)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 1Looks things up and changes nothing.Claude Code: allow

dsar_search_checklistWhere to search when answering a subject access request, especially from an employee: Microsoft 365 (Exchange and archives, shared mailboxes, Teams, OneDrive, SharePoint), other co…No findings
Why it is in this group
- The name "dsar_search_checklist" says "search": a word for reading.
Description, as the server wrote it
Where to search when answering a subject access request, especially from an employee: Microsoft 365 (Exchange and archives, shared mailboxes, Teams, OneDrive, SharePoint), other collaboration tools, HR, payroll, recruitment, CCTV, access logs, devices, line manager notes, paper files, occupational health and backups; search-term tips; and the search standard (UK GDPR Art. 15(1A) reasonable and proportionate searches). General information, not legal advice.
Annotations the server declares
- title: DSAR search checklist
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http dsar https://www.doubleaigents.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__dsar__dsar_search_checklist"
    ],
    "ask": [
      "mcp__dsar__dsar_deadline",
      "mcp__dsar__dsar_quote",
      "mcp__dsar__dsar_service_info",
      "mcp__dsar__dsar_request_scoping",
      "mcp__dsar__breach_clock",
      "mcp__dsar__dsar_letter_template",
      "mcp__dsar__breach_triage",
      "mcp__dsar__ai_tool_check",
      "mcp__dsar__hr_retention"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as dsar. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.doubleaigents.www/dsar/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:54 UTC.

For agents: Markdown · JSON · report this listing