Regulane compliance check

com.regulanePublished by regulane.comOfficial publisherv1.0.0Updated Oct 26, 2026

Check code against secure-coding rules mapped to ISO 27001 and the DPDP Act. Free, no account.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Regulane lets a coding assistant check code against 34 secure-coding rules mapped to ISO 27001 and the DPDP Act, and return a severity scorecard.

What you can do
  • Fetch the workspace's secure-coding rules, including what to look for, how to fix each issue, and the ISO 27001 Annex A controls and DPDP Act sections they evidence
  • Report a compliance check as a scorecard: findings by severity, affected controls and sections, and a fix for each finding
  • Report a clean check as well as one with findings
When to use it
Useful when an assistant is finishing a change that touches authentication, access control, personal data, cryptography, logging, dependencies, CI or infrastructure, and you want a quick rule-based review with control mapping. It is a self-check by the agent, not a certification, audit opinion or penetration test.
Requirements
A remote MCP endpoint; no account, API key or environment variable is needed for the free check. The agent reads the code locally and sends only metadata and one-sentence findings. A workspace token is only needed to keep history for audits.
Before you install
The agent must not send source code, secrets or personal data; only file paths, line numbers and one-sentence findings should go out. Repository name or address, branch, commit, agent name, scope line and rule IDs are still sent to the vendor, with secret-, email- and ID-like values replaced on arrival. Free checks are not stored; connecting a workspace token keeps checks as audit evidence. A clean scorecard is not a certification or audit.

Installation

In SourceWeft

  1. Open Regulane compliance check in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.regulane%2Fcompliance/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "regulane-compliance-check": {
      "type": "http",
      "url": "https://regulane.com/api/mcp"
    }
  }
}

README

Regulane for coding agents

A free compliance check inside the coding agent you already use. Your agent checks your code against Regulane's 34 secure-coding rules, each mapped to ISO/IEC 27001:2022 Annex A controls and, for personal data, the DPDP Act 2023, and you get back a scorecard: findings by severity, the controls they affect, and the fix for each.

Regulane never receives your code. Your agent reads it on your machine and reports only file paths, line numbers and one-sentence findings. No account is needed, and a free check is not stored.

More: regulane.com/coding-agents

Use it

Ask your agent:

Check this repository with Regulane.

The agent calls get_compliance_rules, reviews the code in scope, then calls report_compliance_check and shows you the scorecard. It can then make the fixes and check again. In Claude Code the skill is also available as /regulane:compliance-check.

Install

This repository is a plugin for Claude, Codex and Cursor, and an extension for Gemini CLI. Each loads the same MCP server, https://regulane.com/api/mcp, and the same skill.

AgentInstall
Claude Code/plugin marketplace add siddhantmallah/regulane-agent-plugin, then /plugin install regulane@regulane
Gemini CLIgemini extensions install https://github.com/siddhantmallah/regulane-agent-plugin
Codex, Cursor, Claude (app)From each product's plugin directory, once listed

Or add only the MCP server, with no plugin:

bash
claude mcp add --transport http regulane https://regulane.com/api/mcpcodex mcp add regulane --url https://regulane.com/api/mcpgemini mcp add --transport http regulane https://regulane.com/api/mcp

Setup for VS Code, Cursor, Windsurf and other agents: regulane.com/coding-agents#setup.

What is in this repository

PathFor
skills/compliance-check/SKILL.mdThe skill every agent follows: scope, rules, report, scorecard
.claude-plugin/Claude plugin manifest and Claude Code marketplace
.codex-plugin/Codex plugin manifest
.cursor-plugin/, mcp.jsonCursor plugin manifest and MCP config
.mcp.jsonMCP config for Claude and Codex
gemini-extension.json, GEMINI.mdGemini CLI extension
server.jsonListing in the official MCP Registry (com.regulane/compliance)

There is no code to install: only Markdown and JSON pointing at the hosted server.

Data

What your agent sends to regulane.com: the repository name or address (any credentials in it are removed), branch, commit, which agent ran the check, one line describing the scope, the rule ids checked, and for each finding a file path, line number and one sentence. Anything that looks like a secret, an email address, or a card, Aadhaar or PAN number is replaced on arrival. A free check is turned into a scorecard, sent back, and not stored.

Teams can keep every check as audit evidence by connecting a Regulane workspace with an agent token; those checks are kept in the workspace. See the privacy notice, section 4c.

What it is not

A clean scorecard means your agent checked the code it was given against these rules and found nothing. It is not a certification, an audit opinion or a penetration test, and Regulane does not run or scan your code itself.

Support

[email protected] · regulane.com/contact

License

MIT

Source: README.md at commit 2a16f76

Tools

2

get_compliance_rules

Get Regulane secure-coding rules

Returns the workspace's secure-coding rules: what to look for, how to fix it, and the ISO 27001 Annex A controls and DPDP Act sections each rule evidences. Call this before reviewing a change, then report with report_compliance_check.

Parametersareas

report_compliance_check

Get a Regulane compliance scorecard

Turns the check you ran against the rules from get_compliance_rules into a scorecard: findings by severity, the ISO 27001 controls and DPDP Act sections affected, and the fix for each. Report a clean check too. Regulane does not store it. Send no source code, secrets or personal data.

Parametersagentscoperequiredbranchcommitfindingsrequiredrepositoryrequiredrules_checkedrequired

Version history

1
  1. v1.0.0LatestOct 26, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts