Double AIgents DSAR service

com.doubleaigents.wwwPublished by www.doubleaigents.comOfficial publisherv1.2.0Updated Oct 25, 2026

GDPR DSAR deadlines, breach triage, AI tool checks, HR retention and letters (UK/EU/CH)

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

A public, read-only MCP server that gives an assistant UK, EU/EEA and Swiss data-protection reference tools for DSARs, breaches, AI tool checks and HR retention

What you can do
Calculate DSAR deadlines and breach notification clocks, with the rule and extension position for the UK, EU/EEA or Switzerland. Draft acknowledgement, extension and clarification letters for subject access requests, with dates filled in. Triage a personal data breach for likely reportability and screen a planned AI tool for DPIA and EU AI Act risk flags. Look up recommended UK HR retention periods and where to search for an employee DSAR. Get fixed DSAR pricing, service scope and a prefilled email to start free scoping.
When to use it
Useful for privacy, HR or compliance work where an assistant needs quick, sourced answers on DSAR timing, breach notification, AI tool screening or record retention across UK, EU/EEA and Swiss law. It is general information, not legal advice, and the controller still decides.
Requirements
A remote Streamable HTTP endpoint; no authentication, API key or account is needed. Any MCP client that supports Streamable HTTP can connect.
Before you install
Outputs are general information, not legal advice, and the controller remains responsible for decisions. The scoping tool returns a prefilled email to the provider and should not be given the requester's personal data or the request letter. The quote tool returns commercial pricing excluding VAT. The server is stateless and logs only time, method, tool name and success.

Installation

In SourceWeft

  1. Open Double AIgents DSAR service in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.doubleaigents.www%2Fdsar/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "double-aigents-dsar-service": {
      "type": "http",
      "url": "https://www.doubleaigents.com/api/mcp"
    }
  }
}

README

Double AIgents DSAR MCP server

A public, read-only MCP server for GDPR subject access requests (DSARs) and personal data breaches, for the UK, the EU and Switzerland.

Endpoint (Streamable HTTP, no auth, no key): https://www.doubleaigents.com/api/mcp Official MCP registry: com.doubleaigents.www/dsar

Tools

ToolWhat it does
dsar_deadlineDue date for a subject access request (UK GDPR Art 12A, EU GDPR Art 12(3), Swiss revFADP), with extension rules
breach_clock72-hour breach notification deadline (UK/EU Art 33), to the hour; Swiss rule
dsar_letter_templateAcknowledgement, extension and clarification letters, UK/EU/CH wording
dsar_quoteFixed price for an outsourced DSAR by page count (GBP/EUR/CHF)
dsar_service_infoWhat the Double AIgents DSAR service covers
dsar_request_scopingHow to start a request (returns a mailto link; stores nothing)
breach_triageLikely reportability of a breach (unlikely / borderline / likely / high risk), with reasons and the 72-hour deadline
ai_tool_checkDPIA screening and EU AI Act risk flags for an AI tool, with sources
hr_retentionHow long to keep 14 common UK HR records, with the legal source
dsar_search_checklistWhere to search for an employee DSAR

General information, not legal advice. The controller decides.

Use it

Claude Code:

bash
claude mcp add --transport http doubleaigents-dsar https://www.doubleaigents.com/api/mcp

Any MCP client that supports Streamable HTTP: point it at the endpoint above.

Privacy

Stateless. No storage, no accounts. Usage is counted as one log line per call (time, method, tool name, success); no arguments, IP addresses or user agents are logged.

Code

api/mcp.ts (the Vercel serverless function) and src/lib/dpTools.ts (the shared rules, also used by the free tools page at https://www.doubleaigents.com/free-tools) are mirrored from our site. No dependencies.

About

Double AIgents Ltd, registered in England and Wales, company no. 17513072, ICO registration ZC272947. Contact: [email protected].

MIT licence.

Source: README.md at commit f63a642

Tools

10

dsar_deadline

DSAR response deadline

Calculate the statutory deadline for answering a data subject access request in the UK, the EU/EEA or Switzerland, with the rule that applies and the extension position. General information, not legal advice.

Parametersextendedjurisdictionrequiredreceived_daterequired

dsar_quote

DSAR fixed-price quote

Fixed price from Double AIgents for preparing a DSAR response, by pack size in pages after de-duplication. Also gives the retainer price (15% off). Excludes VAT.

Parameterspagesrequiredcurrency

dsar_service_info

DSAR service information

What the Double AIgents DSAR service covers: scoping, collection guidance, de-duplication, redaction, exemption recommendations, two independent reviews, secure delivery, data handling, jurisdictions and partner arrangements.

Takes no parameters.

dsar_request_scoping

Start DSAR scoping

Explains how to start free scoping and returns a prefilled email (mailto URL) to [email protected]. Sends nothing and stores nothing. Do not pass the requester's personal data or the request letter.

Parameterscontact_namerequiredjurisdictionrequiredorganisationrequiredapprox_volumecontact_emailrequireddate_receivedrequired

breach_clock

Personal data breach notification clock

When a personal data breach must be notified to the regulator: 72 hours from awareness in the UK and EU/EEA (Art. 33), "as soon as possible" in Switzerland (revised FADP Art. 24). Gives the deadline, the rule, the processor and individual-notification position, and the facts the regulator will ask for. The controller decides whether to notify. General information, not legal advice.

Parametersaware_atrequiredjurisdictionrequired

dsar_letter_template

DSAR letter template

Plain-text letter template, in British English with [placeholders], for an acknowledgement, an extension of time or a request for clarification of a data subject access request, under UK, EU/EEA or Swiss law. Fills in the dates if received_date is given. General information, not legal advice.

Parameterskindrequireddue_datejurisdictionrequiredreceived_date

breach_triage

Personal data breach triage

A likely-reportability view on a personal data breach (UK, EU/EEA, Switzerland), following the ICO guide "Personal data breaches: a guide" and EDPB Guidelines 9/2022: whether notifying the regulator and telling the people affected is likely or unlikely to be required, the factors behind that view, and the notification deadline. The controller decides. General information, not legal advice. Do not pass names or other personal data.

Parametersaware_atrequiredencryptedrequiredrecipientrequiredrecoverablerequiredjurisdictionrequiredpeople_affectedrequiredspecial_categoryrequired

ai_tool_check

AI tool check: DPIA and EU AI Act screening

Screens a planned use of an AI tool: whether a DPIA is likely to be required (Art. 35(3), the ICO high-risk list, the WP248 criteria; FADP Art. 22 for Switzerland), EU AI Act risk flags (Annex III high-risk areas, especially employment; Art. 5 prohibited practices such as emotion recognition at work; current application dates after the Digital Omnibus), and automated decision rules (GDPR Art. 22, UK GDPR Arts 22A to 22D). Findings with sources. The use_case text is not stored or returned. General information, not legal advice.

Parametersuse_caserequiredlarge_scalerequiredjurisdictionrequirednew_technologyrequiredspecial_categoryrequiredemployees_or_candidatesrequiredprocesses_personal_datarequiredautomated_decisions_with_significant_effectrequired

hr_retention

HR record retention periods (UK)

Recommended retention period for a common UK HR record, whether it is statutory or only recommended, and the source (HMRC, Home Office, RIDDOR 2013, Working Time Regulations, Limitation Act 1980, ICO, DBS). UK only for now. General information, not legal advice.

Parametersrecord_typerequiredjurisdiction

dsar_search_checklist

DSAR search checklist

Where to search when answering a subject access request, especially from an employee: Microsoft 365 (Exchange and archives, shared mailboxes, Teams, OneDrive, SharePoint), other collaboration tools, HR, payroll, recruitment, CCTV, access logs, devices, line manager notes, paper files, occupational health and backups; search-term tips; and the search standard (UK GDPR Art. 15(1A) reasonable and proportionate searches). General information, not legal advice.

Parametersorganisation_typerequired

Version history

1
  1. v1.2.0LatestOct 18, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts