com.aiactradar/ai-act-radar MCP Server

The com.aiactradar/ai-act-radar server provides EU AI Act obligations and updates sourced from ten official sources, including a national layer. It exposes four tools and is documented via runnable webhook receiver examples for the AI Act Radar system.

🛠️ Key Features

EU AI Act obligations and updates from ten official sources (including national layer)
Four available tools
Example webhook receivers for AI Act Radar
Webhook receiver behavior (per readme excerpt):
- Reads the raw request body (signature is over bytes, not parsed JSON)
- Validates X-AIAR-Timestamp is within 300 seconds of now
- Verifies X-AIAR-Signature (v1=<hex>) using HMAC-SHA-256 over <timestamp>.<raw_body> in constant time
- Checks idempotency key (event.id) to handle retries
- Intended to return 2xx within 5 seconds

🚀 Use Cases

Receiving AI Act Radar webhook events with signature validation
Processing updates where retries and idempotency handling are required
Integrating across multiple platforms via self-contained examples

⚡ Developer Benefits

Signature verification based on raw bytes: <timestamp>.<raw_body>
Constant-time HMAC-SHA-256 comparison guidance
Idempotency-key support using event.id
Time-window enforcement using X-AIAR-Timestamp (300 seconds)

⚠️ Limitations

Receiver example documentation is truncated after the “Returns 2xx within 5 seconds; otherwise…” statement, so additional behavior is not fully specified.

{ "type": "object", "properties": { "since": { "type": "string", "description": "ISO 8601 timestamp; only events published after this. Optional." }, "until": { "type": "string", "description": "ISO 8601 timestamp; only events published before this. Optional." }, "source_id": { "type": "string", "description": "One of: eurlex, aioffice, aiboard, codeofpractice, haveyoursay, cen, bnetza, bfdi, bsi, cnil, nl-algoritmeregister, oecdai. Optional." }, "topics": { "type": "array", "items": { "type": "string" }, "description": "Topic taxonomy. e.g. [\"gpai\",\"transparency\",\"high-risk\"]. Optional." }, "severity_min": { "type": "string", "enum": [ "info", "low", "medium", "high", "critical" ], "description": "Minimum severity. Optional." }, "limit": { "type": "integer", "minimum": 1, "maximum": 200, "default": 25 } } }

{ "type": "object", "properties": { "role": { "type": "string", "enum": [ "provider", "deployer", "distributor", "importer", "gpai-provider" ], "description": "The AI Act role you operate as." }, "risk_category": { "type": "string", "enum": [ "prohibited", "high-risk", "limited-risk", "minimal-risk", "gpai", "gpai-systemic-risk" ], "description": "The AI Act risk classification of the system you offer or use." } }, "required": [ "role", "risk_category" ] }

{ "type": "object", "properties": { "since": { "type": "string", "description": "ISO 8601 date; the digest covers everything from this date forward." }, "topics": { "type": "array", "items": { "type": "string" }, "description": "Restrict digest to these topics. Optional." }, "language": { "type": "string", "enum": [ "en", "de" ], "default": "en" } }, "required": [ "since" ] }

{ "type": "object", "properties": { "article": { "type": "string", "description": "Article identifier — e.g. \"Art. 53\", \"Art. 53(1)(d)\", \"Annex III\", \"Recital 60\"." } }, "required": [ "article" ] }

What every receiver does

Reads the raw request body (signature is over the bytes, not the parsed JSON).

Verifies X-AIAR-Timestamp is within 300 seconds of now.

Verifies X-AIAR-Signature (v1=<hex>) using HMAC-SHA-256 over <timestamp>.<raw_body> in constant time.

Checks an idempotency key (event.id) before doing real work — retries are normal.

Returns 2xx within 5 seconds; otherwise the dispatcher retries with exponential backoff.

The verification is identical across platforms; only the platform glue differs.

Examples

Folder

Platform

Notes

cloudflare-workers/

Cloudflare Workers

Web Crypto API, KV for idempotency

vercel-edge/

Vercel Edge Functions

Web Crypto API, Vercel KV for idempotency

aws-lambda/

AWS Lambda + API Gateway

Node crypto module, DynamoDB for idempotency

express-node/

Plain Express on Node

Node crypto, in-process LRU (replace for prod)

fastify-typescript/

Fastify + TS

Typed body parser, raw-body capture

deno-deploy/

Deno Deploy

Deno KV for idempotency

Try it without signing up

Each example has a test.sh that signs a sample event with a local secret and posts it to the running receiver. You can run the full loop on your laptop in under five minutes:

bash

cd cloudflare-workers
cp .dev.vars.example .dev.vars   # set AIA_SECRET to anything
npm install && npm run dev       # starts http://localhost:8787
# in another terminal:
bash test.sh                     # posts a signed sample event

Going to production

Store AIA_SECRET in your platform's secret manager. Never commit it.

Rotate the secret in the AI Act Radar dashboard at least every 90 days.

Subscribe to the dispatcher's webhook health channel — bounced deliveries surface there before customers notice.

Idempotency stores need a TTL of at least 7 days; the dispatcher retries up to 24h.

Install

Tools (4)

query_ai_act_updatesget_obligation_for_rolesummarize_changes_sincelookup_article

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.aiactradar.com/mcp/v1

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "ai-act-radar": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.aiactradar.com/mcp/v1"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

AI Act Radar

com.aiactradar/ai-act-radar MCP Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

query_ai_act_updates

get_obligation_for_role

summarize_changes_since

lookup_article

aiactradar-examples