io.github.ark-forge/mcp-eu-ai-act

Official16 toolsLive

by ark-forge · Python

EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.

This MCP server performs an EU AI Act + GDPR compliance scan. It is described as a “One call, no arguments” operation that completes in about 10 seconds, detecting 22 AI frameworks. It exposes tooling consistent with Model Context Protocol usage and focuses on regulatory compliance for AI systems.

🛠️ Key Features

EU AI Act + GDPR compliance scanner
One call, no arguments
~10 seconds execution time
Detects 22 AI frameworks
Tooling count: 16

🚀 Use Cases

Checking AI governance and compliance posture for EU AI Act and GDPR
Auditing LLM-related stacks against detected frameworks
Integrating compliance scanning into MCP-based workflows

⚡ Developer Benefits

Simple invocation (“no arguments”)
Fast scan time (~10 seconds)
MCP server packaged under the model-context-protocol ecosystem

⚠️ Limitations

Scope is limited to EU AI Act + GDPR compliance scanning (as described)
Detection coverage is limited to the 22 frameworks noted

Topics

ai-governance, ai-safety, claude, compliance, eu-ai-act, mcp, model-context-protocol, regulation, ai-regulation, gdpr, llm, mcp-server, compliance-scanner, python

Topics

ai-governanceai-safetyclaudecomplianceeu-ai-actmcpmodel-context-protocolregulationai-regulationgdprllmmcp-servercompliance-scannerpython

Captured live from the server via tools/list.

scan_project

Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.

Parameters2

project_path	string	optional	Path to the project root. Omit entirely or pass '.' to scan the current working directory — no path discovery needed.
follow_imports	boolean	optional	When true, also flag files that transitively import AI-flagged modules. Default false is fine for most projects.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Omit entirely or pass '.' to scan the current working directory — no path discovery needed.",
      "title": "Project Path",
      "type": "string"
    },
    "follow_imports": {
      "default": false,
      "description": "When true, also flag files that transitively import AI-flagged modules. Default false is fine for most projects.",
      "title": "Follow Imports",
      "type": "boolean"
    }
  },
  "title": "scan_projectArguments"
}

check_compliance

Check whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.

Parameters2

project_path	string	optional	Path to the project root. Omit entirely or pass '.' to check the current working directory.
risk_category	any	optional	EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Omit entirely or pass '.' to check the current working directory.",
      "title": "Project Path",
      "type": "string"
    },
    "risk_category": {
      "$ref": "#/$defs/RiskCategory",
      "default": "limited",
      "description": "EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'."
    }
  },
  "$defs": {
    "RiskCategory": {
      "description": "EU AI Act risk categories",
      "enum": [
        "unacceptable",
        "high",
        "limited",
        "minimal"
      ],
      "title": "RiskCategory",
      "type": "string"
    }
  },
  "title": "check_complianceArguments"
}

generate_report

Generate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.

Parameters2

project_path	string	optional	Path to the project root. Omit entirely or pass '.' to scan the current working directory.
risk_category	any	optional	EU AI Act risk category: 'minimal', 'limited' (default), 'high', or 'unacceptable'.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Omit entirely or pass '.' to scan the current working directory.",
      "title": "Project Path",
      "type": "string"
    },
    "risk_category": {
      "$ref": "#/$defs/RiskCategory",
      "default": "limited",
      "description": "EU AI Act risk category: 'minimal', 'limited' (default), 'high', or 'unacceptable'."
    }
  },
  "$defs": {
    "RiskCategory": {
      "description": "EU AI Act risk categories",
      "enum": [
        "unacceptable",
        "high",
        "limited",
        "minimal"
      ],
      "title": "RiskCategory",
      "type": "string"
    }
  },
  "title": "generate_reportArguments"
}

suggest_risk_category

Describe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.

Parameters1

system_description

string

required

Short description of what the AI system does, e.g. 'chatbot for customer support' or 'CV screening tool for recruitment'.

Raw schema

{
  "type": "object",
  "properties": {
    "system_description": {
      "description": "Short description of what the AI system does, e.g. 'chatbot for customer support' or 'CV screening tool for recruitment'.",
      "title": "System Description",
      "type": "string"
    }
  },
  "required": [
    "system_description"
  ],
  "title": "suggest_risk_categoryArguments"
}

generate_compliance_templates

Stop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.

Parameters1

risk_category

any

optional

EU AI Act risk category. Templates are most useful for 'high' risk.

Raw schema

{
  "type": "object",
  "properties": {
    "risk_category": {
      "$ref": "#/$defs/RiskCategory",
      "default": "high",
      "description": "EU AI Act risk category. Templates are most useful for 'high' risk."
    }
  },
  "$defs": {
    "RiskCategory": {
      "description": "EU AI Act risk categories",
      "enum": [
        "unacceptable",
        "high",
        "limited",
        "minimal"
      ],
      "title": "RiskCategory",
      "type": "string"
    }
  },
  "title": "generate_compliance_templatesArguments"
}

generate_compliance_roadmap

Get a prioritized, week-by-week plan to close every compliance gap before Aug 2026 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.

Parameters3

project_path	string	optional	Path to the project root. Leave empty or pass '.' to scan the current directory.
risk_category	any	optional	EU AI Act risk category.
deadline	string	optional	Target compliance deadline in ISO format.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Leave empty or pass '.' to scan the current directory.",
      "title": "Project Path",
      "type": "string"
    },
    "risk_category": {
      "$ref": "#/$defs/RiskCategory",
      "default": "high",
      "description": "EU AI Act risk category."
    },
    "deadline": {
      "default": "2026-08-02",
      "description": "Target compliance deadline in ISO format.",
      "title": "Deadline",
      "type": "string"
    }
  },
  "$defs": {
    "RiskCategory": {
      "description": "EU AI Act risk categories",
      "enum": [
        "unacceptable",
        "high",
        "limited",
        "minimal"
      ],
      "title": "RiskCategory",
      "type": "string"
    }
  },
  "title": "generate_compliance_roadmapArguments"
}

generate_annex4_package

Build the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.

Parameters3

project_path	string	optional	Path to the project root. Leave empty or pass '.' to scan the current directory.
sign_with_trust_layer	boolean	optional	Certify the package via Trust Layer for Art. 12 audit trail.
trust_layer_key	string	optional	ArkForge Trust Layer API key. Required if sign_with_trust_layer is True.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Leave empty or pass '.' to scan the current directory.",
      "title": "Project Path",
      "type": "string"
    },
    "sign_with_trust_layer": {
      "default": false,
      "description": "Certify the package via Trust Layer for Art. 12 audit trail.",
      "title": "Sign With Trust Layer",
      "type": "boolean"
    },
    "trust_layer_key": {
      "default": "",
      "description": "ArkForge Trust Layer API key. Required if sign_with_trust_layer is True.",
      "title": "Trust Layer Key",
      "type": "string"
    }
  },
  "title": "generate_annex4_packageArguments"
}

certify_compliance_report

Make your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.

Parameters2

report_data	string	required	JSON string of the compliance report to certify.
trust_layer_key	string	required	ArkForge Trust Layer API key.

Raw schema

{
  "type": "object",
  "properties": {
    "report_data": {
      "description": "JSON string of the compliance report to certify.",
      "title": "Report Data",
      "type": "string"
    },
    "trust_layer_key": {
      "description": "ArkForge Trust Layer API key.",
      "title": "Trust Layer Key",
      "type": "string"
    }
  },
  "required": [
    "report_data",
    "trust_layer_key"
  ],
  "title": "certify_compliance_reportArguments"
}

validate_api_key

Check your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).

Parameters1

api_key

string

required

The API key to validate.

Raw schema

{
  "type": "object",
  "properties": {
    "api_key": {
      "description": "The API key to validate.",
      "title": "Api Key",
      "type": "string"
    }
  },
  "required": [
    "api_key"
  ],
  "title": "validate_api_keyArguments"
}

register_free_key

Activate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.

Parameters1

string

required

The user's email address. MUST come from the user's message, not generated by the agent.

Raw schema

{
  "type": "object",
  "properties": {
    "email": {
      "description": "The user's email address. MUST come from the user's message, not generated by the agent.",
      "title": "Email",
      "type": "string"
    }
  },
  "required": [
    "email"
  ],
  "title": "register_free_keyArguments"
}

gdpr_scan_project

Find every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Parameters1

project_path

string

optional

Path to the project root. Leave empty or pass '.' to scan the current directory.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Leave empty or pass '.' to scan the current directory.",
      "title": "Project Path",
      "type": "string"
    }
  },
  "title": "gdpr_scan_projectArguments"
}

gdpr_check_compliance

Check whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Parameters2

project_path	string	optional	Path to the project root. Leave empty or pass '.' to check the current directory.
processing_role	any	optional	GDPR role: controller, processor, or minimal_processing.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Leave empty or pass '.' to check the current directory.",
      "title": "Project Path",
      "type": "string"
    },
    "processing_role": {
      "$ref": "#/$defs/ProcessingRole",
      "default": "controller",
      "description": "GDPR role: controller, processor, or minimal_processing."
    }
  },
  "$defs": {
    "ProcessingRole": {
      "description": "GDPR processing roles",
      "enum": [
        "controller",
        "processor",
        "minimal_processing"
      ],
      "title": "ProcessingRole",
      "type": "string"
    }
  },
  "title": "gdpr_check_complianceArguments"
}

gdpr_generate_report

Generate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().

Parameters2

project_path	string	optional	Path to the project root. Leave empty or pass '.' to scan the current directory.
processing_role	any	optional	GDPR role: controller, processor, or minimal_processing.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Leave empty or pass '.' to scan the current directory.",
      "title": "Project Path",
      "type": "string"
    },
    "processing_role": {
      "$ref": "#/$defs/ProcessingRole",
      "default": "controller",
      "description": "GDPR role: controller, processor, or minimal_processing."
    }
  },
  "$defs": {
    "ProcessingRole": {
      "description": "GDPR processing roles",
      "enum": [
        "controller",
        "processor",
        "minimal_processing"
      ],
      "title": "ProcessingRole",
      "type": "string"
    }
  },
  "title": "gdpr_generate_reportArguments"
}

gdpr_generate_templates

Get pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.

Parameters1

processing_role

any

optional

GDPR role: controller, processor, or minimal_processing.

Raw schema

{
  "type": "object",
  "properties": {
    "processing_role": {
      "$ref": "#/$defs/ProcessingRole",
      "default": "controller",
      "description": "GDPR role: controller, processor, or minimal_processing."
    }
  },
  "$defs": {
    "ProcessingRole": {
      "description": "GDPR processing roles",
      "enum": [
        "controller",
        "processor",
        "minimal_processing"
      ],
      "title": "ProcessingRole",
      "type": "string"
    }
  },
  "title": "gdpr_generate_templatesArguments"
}

combined_compliance_report

Run this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.

Parameters3

project_path	string	optional	Path to the project root. Omit entirely or pass '.' to scan the current working directory — no arguments required.
risk_category	any	optional	EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.
processing_role	any	optional	GDPR processing role: 'controller' (default, most common), 'processor', or 'minimal_processing'.

Raw schema

{
  "type": "object",
  "properties": {
    "project_path": {
      "default": ".",
      "description": "Path to the project root. Omit entirely or pass '.' to scan the current working directory — no arguments required.",
      "title": "Project Path",
      "type": "string"
    },
    "risk_category": {
      "$ref": "#/$defs/RiskCategory",
      "default": "limited",
      "description": "EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'."
    },
    "processing_role": {
      "$ref": "#/$defs/ProcessingRole",
      "default": "controller",
      "description": "GDPR processing role: 'controller' (default, most common), 'processor', or 'minimal_processing'."
    }
  },
  "$defs": {
    "ProcessingRole": {
      "description": "GDPR processing roles",
      "enum": [
        "controller",
        "processor",
        "minimal_processing"
      ],
      "title": "ProcessingRole",
      "type": "string"
    },
    "RiskCategory": {
      "description": "EU AI Act risk categories",
      "enum": [
        "unacceptable",
        "high",
        "limited",
        "minimal"
      ],
      "title": "RiskCategory",
      "type": "string"
    }
  },
  "title": "combined_compliance_reportArguments"
}

get_pricing

See pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "title": "get_pricingArguments"
}

README.md18 KBView on GitHub

EU AI Act Compliance Scanner — CLI + MCP Server

PyPI version GitHub Stars Pro Plan — €29/mo

One command. Zero config. Full EU AI Act + GDPR compliance report in under 10 seconds.

bash

pip install eu-ai-act-scanner
eu-ai-act-scanner /path/to/your/project

Detects 16 AI frameworks in your codebase, maps each to binding legal articles, returns pass/fail with fix instructions. Free tier, no API key needed.

August 2, 2026 enforcement deadline. Fines up to 35M EUR or 7% global turnover.

If this tool helps your compliance work, a ⭐ on GitHub helps others discover it.

Need audit-grade proof? Certify every scan with ArkForge Trust Layer — tamper-proof, timestamped compliance evidence. 500 free proofs/month.

Get your compliance report →

Quick Start

CLI (scan any project in 10 seconds)

bash

pip install eu-ai-act-scanner   # or: pip install mcp-eu-ai-act
cd your-project/
eu-ai-act-scanner

Output:

code

========================================================================
  EU AI Act Compliance Scanner
========================================================================

  Files scanned: 42
  AI frameworks detected: 2
    - openai (in 3 files)
    - langchain (in 1 file)

  Risk category: limited
  Compliance score: 4/7 (57%)
  Checks:
    [PASS] Transparency
    [PASS] User Disclosure
    [FAIL] Technical Documentation  → Create docs/TECHNICAL_DOCUMENTATION.md
    [FAIL] Risk Management          → Create docs/RISK_MANAGEMENT.md
    [FAIL] Data Governance          → Create docs/DATA_GOVERNANCE.md

Or specify a path directly: eu-ai-act-scanner /path/to/your/project

Track compliance over time (free): eu-ai-act-scanner . --register you@email.com

Free vs Pro

	Free	Pro (€29/mo)	Certified (€99/mo)
Scans per day	5	Unlimited	Unlimited
AI framework detection	✓ (16 frameworks)	✓ (16 frameworks)	✓ (16 frameworks)
Risk category suggestion	✓	✓	✓
Compliance check	—	✓ (content scoring 0-100)	✓
Full compliance report	—	✓ (executive + technical)	✓
Compliance roadmap	—	✓ (week-by-week plan)	✓
Annex IV package	—	✓ (auditor-ready ZIP)	✓
GDPR scan	—	✓	✓
Combined EU AI Act + GDPR	—	✓ (dual-compliance hotspots)	✓
Trust Layer certification	—	—	✓ (cryptographic proof)
CI/CD integration	—	✓	✓
API key	Not required	✓	✓
Tools available	2	10	10 + certification

Free tier: no sign-up, no API key — just pip install and scan. Pro unlocks the full compliance toolkit your team needs before the August 2027 deadline.

→ Compare plans & get your API key

What's New in v2

Feature	Description
`generate_compliance_roadmap`	Week-by-week action plan to reach compliance before your deadline
`generate_annex4_package`	Auditor-ready ZIP with all 8 Annex IV sections populated from your code
`certify_compliance_report`	Cryptographic proof via Trust Layer (EU AI Act Art. 12)
Content scoring	`check_compliance` now scores document content (0-100), not just existence
Article mapping	Every finding mapped to specific EU AI Act article

MCP Server (from source)

bash

git clone https://github.com/ark-forge/mcp-eu-ai-act.git
cd mcp-eu-ai-act
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python3 server.py

Run tests

bash

pip install pytest
pytest tests/ -v

MCP Integration

Install from PyPI (recommended)

bash

pip install eu-ai-act-scanner

Claude Code

bash

claude mcp add eu-ai-act -- eu-ai-act-mcp

Claude Desktop

Add to claude_desktop_config.json:

json

{
  "mcpServers": {
    "eu-ai-act": {
      "command": "eu-ai-act-mcp"
    }
  }
}

Cursor

Add to .cursor/mcp.json:

json

{
  "mcpServers": {
    "eu-ai-act": {
      "command": "eu-ai-act-mcp"
    }
  }
}

HTTP mode (for CI/CD or remote clients)

bash

pip install uvicorn
python3 server.py --http
# Listening on 0.0.0.0:8089

{
  "suggested_category": "high",
  "confidence": "high",
  "matched_criteria": ["Annex III, Category 4 — AI in employment decisions"],
  "obligations_summary": "Technical documentation, risk management, human oversight, data governance, transparency"
}

6. `generate_compliance_templates`

Returns starter markdown templates for each required compliance document. Save them in docs/ and fill in the bracketed sections.

Key parameters: risk_category (string, default: high)

For high risk: Risk Management (Art. 9), Technical Documentation (Art. 11), Data Governance (Art. 10), Human Oversight (Art. 14), Robustness (Art. 15), Transparency (Art. 13).

7. `generate_annex4_package` — NEW in v2

Generates an auditor-ready ZIP with all 8 Annex IV sections populated from your actual project files. Optionally certifies with Trust Layer for cryptographic proof.

Key parameters: project_path (string, required), sign_with_trust_layer (bool, default: false), trust_layer_key (string, optional)

Example output:

json

{
  "package_path": "/tmp/annex4_myproject_20260407.zip",
  "sha256": "a3f8c2d1...",
  "sections_populated": 8,
  "sections_missing_data": ["section_6_accuracy_metrics"],
  "proof_id": "prf_01j9z8x7w6v5u4t3s2r1",
  "verification_url": "https://trust.arkforge.tech/verify/prf_01j9z8x7w6v5u4t3s2r1"
}

8. `certify_compliance_report` — NEW in v2

Certifies any compliance report with ArkForge Trust Layer. Returns a tamper-proof proof_id and public verification URL for your auditor (EU AI Act Art. 12 audit trail).

Key parameters: report_data (string, JSON-serialized report), trust_layer_key (string, required)

Example output:

json

{
  "proof_id": "prf_01j9z8x7w6v5u4t3s2r1",
  "timestamp": "2026-04-07T14:32:00Z",
  "sha256": "a3f8c2d1e4b5...",
  "verification_url": "https://trust.arkforge.tech/verify/prf_01j9z8x7w6v5u4t3s2r1",
  "article": "EU AI Act Art. 12"
}

9. `gdpr_scan_project`

Scans for personal data processing patterns: PII fields, tracking pixels, geolocation, file uploads, cookie patterns. Maps to GDPR Art. 22/35 requirements.

Key parameters: project_path (string, required)

10. `combined_compliance_report`

Runs GDPR + EU AI Act scans simultaneously and identifies dual-compliance hotspots — files where both regulations apply at once.

Key parameters: project_path (string, required), risk_category (string, default: limited)

Example output:

json

{
  "hotspots": [
    {
      "file": "src/hiring_model.py",
      "eu_ai_act_risk": "high",
      "gdpr_risk": "high",
      "overlap_patterns": ["AI+PII", "AI+automated_decision"],
      "combined_articles": ["EU AI Act Art. 14", "GDPR Art. 22"],
      "priority": "critical"
    }
  ],
  "key_insight": "2 files require simultaneous GDPR + EU AI Act remediation"
}

Certify Your Compliance (EU AI Act Art. 12)

The only MCP that generates cryptographically certified compliance evidence.

python

# Step 1: Generate Annex IV package and certify it
generate_annex4_package(
    project_path="/path/to/project",
    sign_with_trust_layer=True,
    trust_layer_key="your_trust_layer_key"
)
# → Returns proof_id + public verification URL for your auditor

# Step 2: Or certify any compliance report directly
certify_compliance_report(
    report_data='{"compliance_percentage": 87, "risk_category": "high"}',
    trust_layer_key="your_trust_layer_key"
)

Free Trust Layer account: 500 certified proofs/month → arkforge.tech

Pricing

Plan	Price	Includes
Free	€0	5 scans/day · scan_project + suggest_risk_category
Pro	€29/month	Unlimited scans · all 10 tools · compliance roadmap · Annex IV package
Certified	€99/month	Everything in Pro + Trust Layer certification on every report

Get your API key →

REST API

A separate HTTP API (paywall_api.py) provides rate-limited REST endpoints for CI/CD and external clients.

bash

python3 paywall_api.py
# Listening on 0.0.0.0:8091

Method	Path	Auth	Description
`GET`	`/api/v1/status`	None	Service status + your rate limit
`GET`	`/api/usage`	None	Current free-tier usage for your IP
`POST`	`/api/v1/scan`	Free/Pro	Scan a project for AI frameworks
`POST`	`/api/v1/check-compliance`	Free/Pro	Check EU AI Act compliance
`POST`	`/api/v1/generate-report`	Free/Pro	Full compliance report
`POST`	`/api/v1/scan-repo`	Free (rate-limited)	Scan a public HTTPS Git repo by URL (port 443, public hosts only)
`POST`	`/api/checkout`	None	Stripe checkout session
`POST`	`/api/webhook`	Stripe sig	Stripe webhook handler

Free tier: 5 scans/day per IP, no sign-up required. Pro tier: Unlimited scans, X-API-Key header. 29 EUR/month via arkforge.tech/pricing.

Example: scan via REST

bash

curl -X POST https://arkforge.tech/mcp/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"project_path": "/path/to/your/project"}'

Configuration

For the REST API (Stripe payments, email notifications), create a settings.env:

env

STRIPE_LIVE_SECRET_KEY=sk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...
TRUST_LAYER_INTERNAL_SECRET=<random-64-char-hex>
SMTP_HOST=ssl0.ovh.net
IMAP_USER=contact@example.com
IMAP_PASSWORD=...

Set SETTINGS_ENV_PATH to the file location (defaults to /opt/claude-ceo/config/settings.env).

Supported Frameworks (16)

Framework	Detection covers
OpenAI	GPT-3.5, GPT-4, GPT-4o, o1, o3, embeddings
Anthropic	Claude (Opus, Sonnet, Haiku)
Google Gemini	Gemini Pro, Ultra, 1.5, 2, 3, Flash
Vertex AI	Google Cloud AI Platform
Mistral	Mistral Large/Medium/Small, Mixtral, Codestral, Magistral
Cohere	Command-R, Command-R+, embeddings
HuggingFace	Transformers, Diffusers, Accelerate, SmolAgents
TensorFlow	Keras, .h5 model files
PyTorch	.pt/.pth model files, nn.Module
LangChain	Core, Community, OpenAI, Anthropic integrations
AWS Bedrock	Bedrock Runtime, Agent Runtime
Azure OpenAI	Azure AI OpenAI Service
Ollama	Local model inference
LlamaIndex	VectorStoreIndex, SimpleDirectoryReader
Replicate	Cloud model inference
Groq	Fast inference API

Detection works on both source code imports and dependency declarations in config files.

EU AI Act Risk Categories

Category	Examples	Key obligations
Unacceptable	Social scoring, mass biometric surveillance	Prohibited
High	Recruitment, credit scoring, law enforcement	Documentation, risk management, human oversight
Limited	Chatbots, content generation	Transparency, user disclosure, content marking
Minimal	Spam filters, video games	None

Limitations

Static analysis only — detects imports and patterns, not runtime behavior
Cannot determine risk category automatically from code alone (use suggest_risk_category with a description)
check_compliance scores content quality — documents with boilerplate/placeholder text will score low
File scanning limited to 5,000 files and 1 MB per file
Certain system paths are blocked from scanning for security

ArkForge ecosystem

This scanner is the first service sold autonomously through the ArkForge Trust Layer — a certifying proxy that turns API calls into verifiable, paid, tamper-proof transactions.

code

Agent Client  →  Trust Layer  →  EU AI Act Scanner
   pays            certifies         delivers

Component	Description	Repo
Trust Layer	Certifying proxy — billing, proof chain, verification	ark-forge/trust-layer
MCP EU AI Act	Compliance toolkit (this repo)	ark-forge/mcp-eu-ai-act
Proof Spec	Open specification + test vectors for the proof format	ark-forge/proof-spec
Agent Client	Autonomous buyer — proof-of-concept of a non-human customer	ark-forge/arkforge-agent-client

Community

Questions / integration help → GitHub Discussions Q&A
Bug reports → Open an issue
Feature requests → Open an issue or join the discussion
Share your experience → Tell us what compliance gaps you found

Roadmap

v3: GPAI obligations module (Art. 51-55, Code of Practice July 2025)
v3: GitHub Action for CI/CD compliance gates
v3: Runtime agentic compliance enforcement (Art. 14)

Found this useful? A ⭐ on GitHub helps other compliance teams discover the toolkit. Takes 2 seconds and helps a lot.

License

MIT

Install

Tools (16)

scan_projectcheck_compliancegenerate_reportsuggest_risk_categorygenerate_compliance_templatesgenerate_compliance_roadmapgenerate_annex4_packagecertify_compliance_report

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.arkforge.tech/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "mcp-eu-ai-act": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.arkforge.tech/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

Topics

scan_project

check_compliance

generate_report

suggest_risk_category

generate_compliance_templates

generate_compliance_roadmap

generate_annex4_package

certify_compliance_report

validate_api_key

register_free_key

gdpr_scan_project

gdpr_check_compliance

gdpr_generate_report

gdpr_generate_templates

combined_compliance_report

get_pricing

EU AI Act Compliance Scanner — CLI + MCP Server

Quick Start

CLI (scan any project in 10 seconds)

Free vs Pro

What's New in v2

MCP Server (from source)

Run tests

MCP Integration

Install from PyPI (recommended)

Claude Code

Claude Desktop

Cursor

HTTP mode (for CI/CD or remote clients)

Tools Reference

1. scan_project

2. check_compliance

3. generate_compliance_roadmap — NEW in v2

4. generate_report

5. suggest_risk_category

6. generate_compliance_templates

7. generate_annex4_package — NEW in v2

8. certify_compliance_report — NEW in v2

9. gdpr_scan_project

10. combined_compliance_report

Certify Your Compliance (EU AI Act Art. 12)

Pricing

REST API

Example: scan via REST

Configuration

Supported Frameworks (16)

EU AI Act Risk Categories

Limitations

ArkForge ecosystem

Community

Roadmap

License

Install

Remote endpoint

Related servers

1. `scan_project`

2. `check_compliance`

3. `generate_compliance_roadmap` — NEW in v2

4. `generate_report`

5. `suggest_risk_category`

6. `generate_compliance_templates`

7. `generate_annex4_package` — NEW in v2

8. `certify_compliance_report` — NEW in v2

9. `gdpr_scan_project`

10. `combined_compliance_report`