Legalithm Mcp Server

io.github.PedramMadaniPublished by GitHub account PedramMadaniv0.2.1Updated Oct 24, 2026

EU AI Act risk classification, obligations and Article 50 disclosures. Offline, no API key.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Offline MCP server that classifies AI features under the EU AI Act, explains obligations and drafts Article 50 disclosures.

What you can do
  • Classify an AI system's EU AI Act risk tier with cited articles and annexes, matched rules and confidence
  • Explain the obligations behind a classification, with counts and top obligation titles
  • Generate Article 50 transparency disclosures
  • Check a committed compliance record against a public API
  • Report when a result is uncertain and flag it for human review instead of guessing
When to use it
Useful when you are building or shipping an AI feature for EU users and want a quick, cited starting point on risk tier and transparency duties inside your editor or agent workflow. It is a starting point, not legal advice or certification.
Requirements
Runs locally over stdio, typically launched with npx from the npm package legalithm-mcp-server. No API key or environment variables are declared; the classify, explain and disclosure tools run fully offline. The record-check tool reads a public API, so it needs network access.
Before you install
Outputs are a cited starting point, not legal advice or a certification, and uncertain results are flagged for human review. The record-check tool contacts an external service. The separate CLI's record commands and GitHub Action require a free API key, and the CLI's content-marking commands need optional native dependencies.

Installation

In SourceWeft

  1. Open Legalithm Mcp Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Legalithm — EU AI Act compliance in your coding loop

[npm version] [Add to Cursor]

Shipping an AI feature to EU users? Article 50 transparency duties have applied since 2 August 2026. Content marking for systems placed before that date is due 2 December 2026, and Annex III high-risk obligations follow on 2 December 2027. Catch it where you code, in seconds.

[Source code on the left, connected by four branching lines to a sealed legal document on the right.]

This image is AI-generated, and it is marked as such with our own tool: legalithm mark --watermark added a C2PA content credential and a pixel watermark, which is what Article 50(2) asks for. Download it and run legalithm verify on it. The credential is signed with the CLI's test certificate, so it is valid but not trust-listed.

Quickstart

Install the offline server in your editor. No API key, and nothing leaves your machine.

bash
claude plugin marketplace add legalithm-org/legalithmclaude plugin install legalithm@legalithm

Codex:

bash
codex plugin marketplace add legalithm-org/legalithmcodex plugin add legalithm@legalithm

Cursor: use the Add to Cursor badge above.

Then ask your agent "does the EU AI Act apply to this feature, and what tier?"

What comes back (real output, CV screening as the provider)
json
{  "risk": "high",  "confidence": "high",  "rationale": "This AI system is classified as high-risk under Article 6(2) as it falls into the category of Employment, Workers Management and Access to Self-employment as specified in Annex III...",  "citations": [    {      "article": "6(2)",      "annex": "III",      "label": "Article 6(2) & Annex III - High-Risk AI Systems",      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#article-6",      "asOf": "2026-08-03",      "appliesFrom": "2027-12-02"    }  ],  "matchedRules": ["high_risk_employment", "high_risk_domain_selected"],  "applicableDeadline": "2027-12-02",  "obligationsHint": {    "count": 10,    "topTitles": [      "Quality Management System (Article 17)",      "Data Governance (Article 10)",      "Technical Documentation (Article 11)",      "Human Oversight (Article 14)"    ]  },  "confidenceScore": 0.72,  "reviewRequired": false}

Note matchedRules, asOf and confidenceScore. You can see which rule fired, how old the corpus is, and how sure the engine was. Below the abstention threshold it sets reviewRequired and tells you to get a human instead of guessing.

Content marking for Article 50(2), also no key:

bash
npm i -g legalithmlegalithm mark ./out.png --watermark   # writes out.signed.pnglegalithm verify ./out.signed.png      # detect both layers

Install it rather than using npx for these two: C2PA and the watermark come from c2pa-node and sharp, which are optional native dependencies that npx does not reliably fetch. Without them mark warns and marks nothing. Everything else in this README works fine under npx.

The compliance record (needs a free key)

bash
npx legalithm setup   # wires hooks, editor rule and MCP confignpx legalithm init    # writes a dated, cited compliance/legalithm.jsonnpx legalithm check   # re-verify; non-zero exit on drift (for CI)

init and check talk to the hosted record service, so they need a free API key. Everything above this line does not.

Three surfaces

  1. Editor — an offline MCP server (legalithm-mcp-server) exposing 4 tools (classify, explain_obligation, generate_disclosure, check_record). No API key. The first three run fully offline; check_record reads a public API.
  2. Repo — legalithm init writes a dated, cited compliance/legalithm.json that records your AI system's risk tier and the obligations behind it.
  3. CI — legalithm check and the GitHub Action fail the build when the committed record drifts — because your app changed or the law changed under you.

MCP config

Add the offline server to Claude Code, Cursor or Codex manually:

json
{  "mcpServers": {    "legalithm": {      "command": "npx",      "args": ["-y", "legalithm-mcp-server"]    }  }}

GitHub Action

yaml
# .github/workflows/ai-act.ymlname: AI Acton: [pull_request]jobs:  ai-act:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: legalithm-org/legalithm/packages/action@v1        with:          api-key: ${{ secrets.LEGALITHM_API_KEY }}

Honest framing

A cited starting point that tells you when to get a human — not legal advice. When unsure, it flags the result for review instead of guessing. Every output is checked against Regulation (EU) 2024/1689; it is not a certification.

Links

License

MIT

Source: README.md at commit 4c5717e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts