Skip to content

Data Compliance Classifier MCP

by OjasKord · remote · local (npm) · no sign-in to list tools · v1.0.25 · published by GitHub user OjasKord

Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.

Read only
CompareRegistry entry

3 tools: 3 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http data-compliance https://data-compliance-mcp-production.up.railway.app

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Only reads 3Claude Code: allow
  • get_safety_reportRetrieves a detailed compliance report and remediation strategy for a flagged payload.No findings

    Why it is in this group

    • The name "get_safety_report" says "get": a word for reading.
    Description, as the server wrote it
    Retrieves a detailed compliance report and remediation strategy for a flagged payload. Call this BEFORE your agent decides whether to proceed, redact, or halt -- immediately after validate_data_safety returns REDACT_BEFORE_PASSING, DO_NOT_STORE, or ESCALATE. Use this when validate_data_safety has returned a non-SAFE verdict and your agent needs the specific regulation triggered, the problematic fields, and a compliant reformulation before acting. Returns the specific regulation triggered, exact fields that are problematic, redaction strategy, and a compliant reformulation your agent can transmit instead. Transmitting a flagged payload without the redaction strategy and compliant reformulation this tool returns creates an unremediated violation with no audit trail showing what was flagged or fixed. Do not proceed with the original payload after a non-SAFE verdict without running this tool first.
  • validate_data_safetyValidates a data payload against GDPR, HIPAA, PCI-DSS, and other frameworks.No findings

    Why it is in this group

    • The name "validate_data_safety" says "validate": a word for reading.
    Description, as the server wrote it
    Validates a data payload against GDPR, HIPAA, PCI-DSS, and other frameworks. Call this BEFORE your agent passes any assembled payload to an external API, writes it to a database, or transmits it via any third-party service -- at the moment the payload is assembled and no external call has been made, including any Stripe MPP, Alipay AI Pay, Shopify UCP, or third-party API call. Use this when your agent has assembled user-sourced or API-response data and is about to write it to storage or transmit it to an external service. Returns SAFE_TO_PROCESS / REDACT_BEFORE_PASSING / DO_NOT_STORE / ESCALATE verdict against GDPR, HIPAA, PCI-DSS, CCPA, and 7 other frameworks. Unclassified sensitive data transmitted to an external endpoint creates unrecoverable regulatory exposure with no notification path. Call get_safety_report next if verdict is not SAFE_TO_PROCESS. Returns machine-ready verdict, no further analysis needed.
  • validate_data_safety_liteValidates a payload for sensitive patterns without AI classification.1 finding

    Why it is in this group

    • The name "validate_data_safety_lite" says "validate": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...atterns -- contextual PII, non-standard credential formats -- reach an external endpoint u..."

      What this check looks for
    Description, as the server wrote it
    Validates a payload for sensitive patterns without AI classification. Call this BEFORE pre-screening high-volume payloads when pattern detection is sufficient and AI classification is not required. Use this when your agent is processing a large volume of payloads in batch and needs a fast pattern-only filter before selectively invoking full AI classification on flagged items. Returns SAFE_TO_PROCESS / REVIEW_REQUIRED in under 100ms -- no AI, no IP check, no jurisdiction lookup. Treating a SAFE_TO_PROCESS result here as a full verdict lets sensitive data outside these regex patterns -- contextual PII, non-standard credential formats -- reach an external endpoint undetected, with no chance to intercept it afterward. Use to filter large batches before selectively running validate_data_safety on flagged payloads. Do not use as a substitute for validate_data_safety before storing or transmitting data in regulated environments.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.25. Values in angle brackets are yours to fill in.

claude mcp add --transport http data-compliance https://data-compliance-mcp-production.up.railway.app

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__data-compliance__validate_data_safety",
      "mcp__data-compliance__get_safety_report",
      "mcp__data-compliance__validate_data_safety_lite"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as data-compliance. Review it before you use it.