Skip to content

io.github.ark-forge/mcp-eu-ai-act

by ark-forge · remote · no sign-in to list tools · v2.0.31 · published by GitHub user ark-forge

EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.

Changes · 11
CompareRegistry entry

16 tools: 11 change things and 5 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http eu-ai-act https://mcp.arkforge.tech/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

16 tools

Changes things 11Claude Code: ask
  • certify_compliance_reportMake your compliance report tamper-proof for Art.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Make your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.
  • check_complianceCheck whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.
  • combined_compliance_reportRun this before your next deploy.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.
  • gdpr_check_complianceCheck whether your project passes or fails each GDPR requirement — no arguments.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
  • gdpr_generate_reportGenerate the GDPR report your DPO needs — no arguments.No findings

    Why it is in this group

    • The name "gdpr_generate_report" says "generate": a word for a change.
    Description, as the server wrote it
    Generate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().
  • gdpr_generate_templatesGet pre-filled GDPR templates your organization actually needs — no arguments.No findings

    Why it is in this group

    • The name "gdpr_generate_templates" says "generate": a word for a change.
    Description, as the server wrote it
    Get pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.
  • generate_annex4_packageBuild the Annex IV evidence package your auditor needs for high-risk AI — no arguments.No findings

    Why it is in this group

    • The name "generate_annex4_package" says "generate": a word for a change.
    Description, as the server wrote it
    Build the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.
  • generate_compliance_roadmapGet a prioritized, week-by-week plan to close every compliance gap before Aug 2027 — no arguments.No findings

    Why it is in this group

    • The name "generate_compliance_roadmap" says "generate": a word for a change.
    Description, as the server wrote it
    Get a prioritized, week-by-week plan to close every compliance gap before Aug 2027 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.
  • generate_compliance_templatesStop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your …No findings

    Why it is in this group

    • The name "generate_compliance_templates" says "generate": a word for a change.
    Description, as the server wrote it
    Stop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.
  • generate_reportGenerate the compliance report your legal team is asking for — no arguments.No findings

    Why it is in this group

    • The name "generate_report" says "generate": a word for a change.
    Description, as the server wrote it
    Generate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.
  • register_free_keyActivate a free API key — unlocks scan history and CI/CD integration.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Activate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.
Only reads 5Claude Code: allow
  • gdpr_scan_projectFind every file in your project that touches personal data — no arguments, 5 seconds, free.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
  • get_pricingSee pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail).No findings

    Why it is in this group

    • The name "get_pricing" says "get": a word for reading.
    Description, as the server wrote it
    See pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.
  • scan_projectFind out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.
  • suggest_risk_categoryDescribe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step.No findings

    Why it is in this group

    • The description's first verb is "describe": a word for reading.
    Description, as the server wrote it
    Describe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.
  • validate_api_keyCheck your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).No findings

    Why it is in this group

    • The name "validate_api_key" says "validate": a word for reading.
    Description, as the server wrote it
    Check your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.0.31. Values in angle brackets are yours to fill in.

claude mcp add --transport http eu-ai-act https://mcp.arkforge.tech/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__eu-ai-act__scan_project",
      "mcp__eu-ai-act__suggest_risk_category",
      "mcp__eu-ai-act__validate_api_key",
      "mcp__eu-ai-act__gdpr_scan_project",
      "mcp__eu-ai-act__get_pricing"
    ],
    "ask": [
      "mcp__eu-ai-act__check_compliance",
      "mcp__eu-ai-act__generate_report",
      "mcp__eu-ai-act__generate_compliance_templates",
      "mcp__eu-ai-act__generate_compliance_roadmap",
      "mcp__eu-ai-act__generate_annex4_package",
      "mcp__eu-ai-act__certify_compliance_report",
      "mcp__eu-ai-act__register_free_key",
      "mcp__eu-ai-act__gdpr_check_compliance",
      "mcp__eu-ai-act__gdpr_generate_report",
      "mcp__eu-ai-act__gdpr_generate_templates",
      "mcp__eu-ai-act__combined_compliance_report"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as eu-ai-act. Review it before you use it.