# `com.doubleaigents.www/dsar` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.doubleaigents.www/dsar
- JSON: https://anlyon.dev/api/v1/servers/com.doubleaigents.www/dsar
- Version: 1.2.0 (active)
- Publisher: com.doubleaigents.www (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/JimmyBoy-Git/doubleaigents-dsar-mcp
- Metadata from the official MCP Registry, synced 2026-10-21T17:54:14.833Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Double AIgents DSAR service
GDPR DSAR deadlines, breach triage, AI tool checks, HR retention and letters (UK/EU/CH)
```

Scanned 2026-10-21T18:33:52.042Z over streamable-http.

**10 tools: 1 do something that can't be undone, 8 change things and 1 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 1 | ask |
| Changes things | write | 8 | ask |
| Only reads | read | 1 | allow |

## Findings

- **warn** Annotations that disagree with the tool in `dsar_request_scoping` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "dsar_request_scoping" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dsar_request_scoping" says "request": a word for a change.
```

- **warn** Annotations that disagree with the tool in `breach_triage` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "breach_triage" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.recipient): what it sends cannot be taken back.
```


## Can't be undone (1)

Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask.

### `breach_triage`

- The input addresses people (input.recipient): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
A likely-reportability view on a personal data breach (UK, EU/EEA, Switzerland), following the ICO guide "Personal data breaches: a guide" and EDPB Guidelines 9/2022: whether notifying the regulator and telling the people affected is likely or unlikely to be required, the factors behind that view, and the notification deadline. The controller decides. General information, not legal advice. Do not pass names or other personal data.
```

## Changes things (8)

Creates or changes something that can be changed back. Claude Code: ask.

### `ai_tool_check`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Screens a planned use of an AI tool: whether a DPIA is likely to be required (Art. 35(3), the ICO high-risk list, the WP248 criteria; FADP Art. 22 for Switzerland), EU AI Act risk flags (Annex III high-risk areas, especially employment; Art. 5 prohibited practices such as emotion recognition at work; current application dates after the Digital Omnibus), and automated decision rules (GDPR Art. 22, UK GDPR Arts 22A to 22D). Findings with sources. The use_case text is not stored or returned. General information, not legal advice.
```

### `breach_clock`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
When a personal data breach must be notified to the regulator: 72 hours from awareness in the UK and EU/EEA (Art. 33), "as soon as possible" in Switzerland (revised FADP Art. 24). Gives the deadline, the rule, the processor and individual-notification position, and the facts the regulator will ask for. The controller decides whether to notify. General information, not legal advice.
```

### `dsar_deadline`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Calculate the statutory deadline for answering a data subject access request in the UK, the EU/EEA or Switzerland, with the rule that applies and the extension position. General information, not legal advice.
```

### `dsar_letter_template`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Plain-text letter template, in British English with [placeholders], for an acknowledgement, an extension of time or a request for clarification of a data subject access request, under UK, EU/EEA or Swiss law. Fills in the dates if received_date is given. General information, not legal advice.
```

### `dsar_quote`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Fixed price from Double AIgents for preparing a DSAR response, by pack size in pages after de-duplication. Also gives the retainer price (15% off). Excludes VAT.
```

### `dsar_request_scoping`

- The name "dsar_request_scoping" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Explains how to start free scoping and returns a prefilled email (mailto URL) to james@doubleaigents.com. Sends nothing and stores nothing. Do not pass the requester's personal data or the request letter.
```

### `dsar_service_info`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
What the Double AIgents DSAR service covers: scoping, collection guidance, de-duplication, redaction, exemption recommendations, two independent reviews, secure delivery, data handling, jurisdictions and partner arrangements.
```

### `hr_retention`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Recommended retention period for a common UK HR record, whether it is statutory or only recommended, and the source (HMRC, Home Office, RIDDOR 2013, Working Time Regulations, Limitation Act 1980, ICO, DBS). UK only for now. General information, not legal advice.
```

## Only reads (1)

Looks things up and changes nothing. Claude Code: allow.

### `dsar_search_checklist`

- The name "dsar_search_checklist" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Where to search when answering a subject access request, especially from an employee: Microsoft 365 (Exchange and archives, shared mailboxes, Teams, OneDrive, SharePoint), other collaboration tools, HR, payroll, recruitment, CCTV, access logs, devices, line manager notes, paper files, occupational health and backups; search-term tips; and the search standard (UK GDPR Art. 15(1A) reasonable and proportionate searches). General information, not legal advice.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `dsar`:

```json
{
  "permissions": {
    "allow": [
      "mcp__dsar__dsar_search_checklist"
    ],
    "ask": [
      "mcp__dsar__dsar_deadline",
      "mcp__dsar__dsar_quote",
      "mcp__dsar__dsar_service_info",
      "mcp__dsar__dsar_request_scoping",
      "mcp__dsar__breach_clock",
      "mcp__dsar__dsar_letter_template",
      "mcp__dsar__breach_triage",
      "mcp__dsar__ai_tool_check",
      "mcp__dsar__hr_retention"
    ],
    "deny": []
  }
}
```