Acf Mcp

io.github.acfstandardPublished by GitHub account acfstandardv2.0.1Updated Nov 3, 2026

Official ACF® MCP server: Agentic Commerce Framework® governance copilot for AI assistants.

Overview

AI-generated overview

Official ACF® MCP server that gives an assistant a governance copilot for AI agents, grounded in the Agentic Commerce Framework's cards, principles and…

What you can do
  • Search the ACF® corpus and look up methodological cards, glossary definitions and verified regulation articles
  • Map external standards (EU AI Act, GDPR, DORA, NIS2, ISO/IEC 42001) to ACF® cards and back
  • Run first-pass assessments: classify an agent, assess autonomy level, identify governance gaps, evaluate an existing mandate
  • Assign DDAO controls and produce the full AI Act obligation list for high-risk systems
  • Produce formatted citations in APA, MLA, Chicago, ISO 690 or BibTeX
When to use it
Useful when drafting or auditing AI agent governance: qualifying an agent before go-live, deciding how much autonomy to grant, preparing board memos, regulatory filings or audits that reference ACF® and the EU AI Act, GDPR, DORA, NIS2 or ISO 42001.
Requirements
Runs as a local stdio process installed from the npm package acf-mcp, so Node.js and npm are needed on the user's machine. No authentication, environment variables or headers are declared. Desktop clients only; not executable in a browser.
Before you install
The assessment tools return preliminary, first-pass guidance with explicit uncertainty signalling, not a compliance certification or legal advice; verify against the source texts before relying on it. Tools are read-only lookups and assessments, with no declared writes, credentials or payments.

Installation

In SourceWeft

  1. Open Acf Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

13

acf.fiche.lookup

When facing a specific governance question (defining an agent's mandate, designing a kill switch, building a decision register…), retrieve the canonical ACF® methodological card that applies: with its example, its mapping to principles and its related cards.

Parameterscoderequiredlocaleinclude_frontmatter

acf.regulation.article

When a regulator, an auditor or a board references a specific article (AI Act Art. 9, GDPR Art. 35, DORA Art. 28, NIS2 Art. 21, ISO 42001 §6…), get the verified text and its operational translation into the ACF® framework: which principles it activates and which fiches operationalise it.

Parameterslocalearticlerequiredregulationrequired

acf.glossary.define

When governance vocabulary becomes ambiguous (what is a DDAO? what does Decision Sovereignty exactly mean? what separates co-decision from supervised autonomy?), get the canonical ACF® definition and its connection to the rest of the doctrine.

Parameterstermrequiredlocale

acf.cite

When writing a thesis, a regulatory filing, a board memo or an academic paper that needs to reference ACF®, produce a properly formatted citation in the requested style (APA, MLA, Chicago, ISO 690, BibTeX).

Parametersurirequiredstylelocale

acf.classify-agent

When a system owner needs a first-pass governance qualification of an AI agent before go-live: what autonomy level it likely operates at, what risk class it likely carries, what regulations apply, what controls to put in place, who should sign off: get one structured preliminary assessment covering all five questions in a single call. Input kept deliberately simple (10 qualified fields); output is structured for human review, not for autonomous regulatory decision-making.

Parametersnamerequiredlocalesectorgpai_usedrequireddescriptionrequiredjurisdictionusage_audiencerequiredai_act_triggersdecisions_takenrequiredexternal_actionsrequiredfinancial_exposurerequiredpersonal_data_levelrequired+2 more

acf.advisor

When a user describes a real AI use case and needs a structured ACF® governance assessment in return: which principles fire, which autonomy level fits, which regulatory obligations apply, which fiches to mobilise in what order, what are the first operational actions, what are the operational risks. This is the conversion tool: from documentation library to governance advisor.

Parameterslocalesectorjurisdictioncase_descriptionrequireddeployment_scale

acf.assess-autonomy

When deciding how much autonomy to grant an agent: should it propose, decide or execute? what triggers human review? what is the kill switch design?: get a first-pass assessment grounded in the 4 ACF® autonomy levels with explicit go/no-go criteria, gating thresholds, and uncertainty signalling for human review.

Parameterslocalereversibilityrequiredintended_actionsrequiredagent_descriptionrequiredaudit_requirementsrequiredhuman_in_loop_cost

acf.identify-governance-gaps

When auditing your current AI governance setup: what does ACF® suggest you should have that you don't?: get a first-pass gap analysis across the 4 ACF® principles, prioritised by criticality, with remediation actions, quick wins, and explicit uncertainty signalling on which gaps were inferred vs declared.

Parameterslocalesectorcurrent_inventoryrequiredcurrent_processesrequired

acf.map-ai-act-obligations

When a system has been preliminarily qualified as high-risk and you need the exhaustive list of AI Act obligations that apply: Art. 9 risk management, Art. 10 data, Art. 11 docs, Art. 12 logs, Art. 13 transparency, Art. 14 human oversight, Art. 15 robustness, GPAI Art. 51-55: get the full obligation set structured by lifecycle phase (pre-go-live / continuous / on-incident) with deadlines (incl. Digital Omnibus deferrals) and ACF® operational translation.

Parametersannexrequiredlocaleuse_caserequiredgpai_usedprovider_or_deployerrequired

acf.assign-ddao-controls

When a DDAO needs concrete controls assigned to an autonomous agent: what kill switches, what escalation thresholds, what audit trails, what documentation, who owns each control: get the ACF® control set scoped to the agent's autonomy level and risk class, with double vocabulary (plain-English recommended_controls + ACF-canonical ddao_controls) for external clarity.

Parameterslocalerisk_levelrequiredautonomy_levelrequiredagent_descriptionrequiredbudget_constraint

acf.evaluate-agent-mandate

When an existing agent mandate already exists (drafted or proposed for DDAO sign-off) and you need a first-pass audit before go-live or regulatory inspection: does it cover the decision perimeter, the escalation thresholds, the kill switch, the audit trail, the documentation duty?: get a structured preliminary verdict with strengths, gaps, required additions, and explicit gaps_to_validate for the human reviewer.

Parameterslocalemandate_textrequiredagent_purposerequireddeployment_context

acf.map-to-standards

When a DDAO, an auditor or a compliance officer needs to know which articles of the major external standards (EU AI Act, GDPR, DORA, NIS2, ISO/IEC 42001) each ACF® methodological card connects to: and which ACF® cards a given external article relies on: get the reverse-index built from the same canonical mapping consumed by acf.regulation.article. Useful for cross-mapping audits, regulator filings, and ACF×AI Act conformity arguments. Pass a single fiche_id (e.g. ACF-07) for a focused view, or call without it for the complete inventory of the toolkit cards that the mapping references.

Parameterslocalefiche_idregulations

Version history

1
  1. v2.0.1LatestNov 1, 2026

Score

65% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.