io.github.ark-forgePublished by GitHub account ark-forgev2.0.31Updated Oct 24, 2026
EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.
Remote MCP server that scans a project for AI frameworks and personal data, then reports EU AI Act and GDPR compliance gaps with fix steps.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.ark-forge%2Fmcp-eu-ai-act/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"eu-ai-act": {
"type": "http",
"url": "https://mcp.arkforge.tech/mcp"
}
}
}[PyPI version] [GitHub Stars] [Start Free] [Pro Plan — €29/mo] [Works with Claude] [Works with Cursor]
One command. Zero config. Full EU AI Act + GDPR compliance report in under 10 seconds.
Detects 16 AI frameworks in your codebase, maps each to binding legal articles, returns pass/fail with fix instructions. Free tier, no API key needed.
August 2, 2026 enforcement deadline. Fines up to 35M EUR or 7% global turnover.
If this tool helps your compliance work, a ⭐ on GitHub helps others discover it.
Need audit-grade proof? Certify every scan with ArkForge Trust Layer — tamper-proof, timestamped compliance evidence. 500 free proofs/month.
Output:
Or specify a path directly: eu-ai-act-scanner /path/to/your/project
Track compliance over time (free): eu-ai-act-scanner . --register [email protected]
Free tier: no sign-up, no API key — just pip install and scan. Pro unlocks the full compliance toolkit your team needs before the August 2027 deadline.
→ Compare plans & get your API key
Add to claude_desktop_config.json:
Add to .cursor/mcp.json:
scan_projectDetects AI framework usage in source code and config/manifest files. Supports 16 frameworks across Python, JS, TS, Go, Java, and Rust.
Key parameters: project_path (string, required)
Example output:
check_complianceScores document content quality (0-100) and maps each finding to a specific EU AI Act article. Score ≥40 = pass. Fully backward compatible with v1.
Key parameters: project_path (string, required), risk_category (string, default: limited)
Example output (v2):
generate_compliance_roadmap — NEW in v2Deadline-aware, week-by-week action plan to reach EU AI Act compliance before August 2, 2026. Sequences quick wins first using a criticality × 1/effort algorithm.
Key parameters: project_path (string, required), risk_category (string), target_date (string, ISO format, default: 2027-08-02)
Example output:
generate_reportRuns scan + compliance check, returns a combined report with two-level output: executive summary for DPO/legal and technical breakdown for developers. Article-by-article citations included.
Key parameters: project_path (string, required), risk_category (string, default: limited)
Example output:
suggest_risk_categoryClassifies your AI system into an EU AI Act risk category from a plain-text description. Matches against Art. 5 (prohibited), Annex III (high-risk), Art. 52 (limited), and minimal.
Key parameters: system_description (string, required)
Example output:
generate_compliance_templatesReturns starter markdown templates for each required compliance document. Save them in docs/ and fill in the bracketed sections.
Key parameters: risk_category (string, default: high)
For high risk: Risk Management (Art. 9), Technical Documentation (Art. 11), Data Governance (Art. 10), Human Oversight (Art. 14), Robustness (Art. 15), Transparency (Art. 13).
generate_annex4_package — NEW in v2Generates an auditor-ready ZIP with all 8 Annex IV sections populated from your actual project files. Optionally certifies with Trust Layer for cryptographic proof.
Key parameters: project_path (string, required), sign_with_trust_layer (bool, default: false), trust_layer_key (string, optional)
Example output:
certify_compliance_report — NEW in v2Certifies any compliance report with ArkForge Trust Layer. Returns a tamper-proof proof_id and public verification URL for your auditor (EU AI Act Art. 12 audit trail).
Key parameters: report_data (string, JSON-serialized report), trust_layer_key (string, required)
Example output:
gdpr_scan_projectScans for personal data processing patterns: PII fields, tracking pixels, geolocation, file uploads, cookie patterns. Maps to GDPR Art. 22/35 requirements.
Key parameters: project_path (string, required)
combined_compliance_reportRuns GDPR + EU AI Act scans simultaneously and identifies dual-compliance hotspots — files where both regulations apply at once.
Key parameters: project_path (string, required), risk_category (string, default: limited)
Example output:
The only MCP that generates cryptographically certified compliance evidence.
Free Trust Layer account: 500 certified proofs/month → arkforge.tech
A separate HTTP API (paywall_api.py) provides rate-limited REST endpoints for CI/CD and external clients.
Free tier: 5 scans/day per IP, no sign-up required.
Pro tier: Unlimited scans, X-API-Key header. 29 EUR/month via arkforge.tech/pricing.
For the REST API (Stripe payments, email notifications), create a settings.env:
Set SETTINGS_ENV_PATH to the file location (defaults to /opt/claude-ceo/config/settings.env).
Detection works on both source code imports and dependency declarations in config files.
suggest_risk_category with a description)check_compliance scores content quality — documents with boilerplate/placeholder text will score lowThis scanner is the first service sold autonomously through the ArkForge Trust Layer — a certifying proxy that turns API calls into verifiable, paid, tamper-proof transactions.
Found this useful? A ⭐ on GitHub helps other compliance teams discover the toolkit. Takes 2 seconds and helps a lot.
MIT
Source: README.md at commit 933e56d
Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.
project_pathfollow_importsCheck whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.
project_pathrisk_categoryGenerate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.
project_pathrisk_categoryDescribe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.
system_descriptionrequiredStop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.
risk_categoryGet a prioritized, week-by-week plan to close every compliance gap before Aug 2027 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.
deadlineproject_pathrisk_categoryBuild the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.
project_pathtrust_layer_keysign_with_trust_layerMake your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.
report_datarequiredtrust_layer_keyrequiredCheck your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).
api_keyrequiredActivate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.
emailrequiredFind every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
project_pathCheck whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
project_pathprocessing_roleGenerate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().
project_pathprocessing_roleGet pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.
processing_roleRun this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.
project_pathrisk_categoryprocessing_roleSee pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.
Takes no parameters.
100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
pip install eu-ai-act-scannereu-ai-act-scanner /path/to/your/projectpip install eu-ai-act-scanner # or: pip install mcp-eu-ai-actcd your-project/eu-ai-act-scanner======================================================================== EU AI Act Compliance Scanner========================================================================
Files scanned: 42 AI frameworks detected: 2 - openai (in 3 files) - langchain (in 1 file)
Risk category: limited Compliance score: 4/7 (57%) Checks: [PASS] Transparency [PASS] User Disclosure [FAIL] Technical Documentation → Create docs/TECHNICAL_DOCUMENTATION.md [FAIL] Risk Management → Create docs/RISK_MANAGEMENT.md [FAIL] Data Governance → Create docs/DATA_GOVERNANCE.mdgit clone https://github.com/ark-forge/mcp-eu-ai-act.gitcd mcp-eu-ai-actpython3 -m venv .venv && source .venv/bin/activatepip install -r requirements.txtpython3 server.pypip install pytestpytest tests/ -vpip install eu-ai-act-scannerclaude mcp add eu-ai-act -- eu-ai-act-mcp{ "mcpServers": { "eu-ai-act": { "command": "eu-ai-act-mcp" } }}{ "mcpServers": { "eu-ai-act": { "command": "eu-ai-act-mcp" } }}pip install uvicornpython3 server.py --http# Listening on 0.0.0.0:8089{ "files_scanned": 42, "ai_files": [ {"file": "src/chat.py", "frameworks": ["openai"]}, {"file": "requirements.txt", "frameworks": ["openai"], "source": "config"} ], "detected_models": {"openai": ["src/chat.py", "requirements.txt"]}}{ "risk_category": "high", "compliance_score": "4/6", "compliance_percentage": 66.7, "content_scores": { "RISK_MANAGEMENT.md": 82, "TRANSPARENCY.md": 45, "DATA_GOVERNANCE.md": 12 }, "article_map": { "art_9": {"status": "pass", "score": 82}, "art_10": {"status": "fail", "score": 12}, "art_13": {"status": "pass", "score": 45} }}{ "weeks_remaining": 16, "phases": [ { "week": 1, "action": "Add TRANSPARENCY.md with user disclosure statement", "article": "Art. 13", "effort_days": 1, "priority": "critical" }, { "week": 2, "action": "Draft risk management procedure covering Art. 9 requirements", "article": "Art. 9", "effort_days": 3, "priority": "high" } ], "estimated_completion_week": 8}{ "executive_summary": { "compliance_percentage": 67, "deadline": "2027-08-02", "days_remaining": 117, "gap_count": 3, "verdict": "Action required — 3 gaps must be addressed before deadline" }, "technical_breakdown": { "art_9": {"status": "fail", "missing": ["hazard identification section", "residual risk log"]}, "art_13": {"status": "pass", "score": 78} }, "recommendations": [ {"article": "Art. 9", "action": "Add hazard identification section to RISK_MANAGEMENT.md", "effort": "2 days"} ]}{ "suggested_category": "high", "confidence": "high", "matched_criteria": ["Annex III, Category 4 — AI in employment decisions"], "obligations_summary": "Technical documentation, risk management, human oversight, data governance, transparency"}{ "package_path": "/tmp/annex4_myproject_20260407.zip", "sha256": "a3f8c2d1...", "sections_populated": 8, "sections_missing_data": ["section_6_accuracy_metrics"], "proof_id": "prf_01j9z8x7w6v5u4t3s2r1", "verification_url": "https://trust.arkforge.tech/verify/prf_01j9z8x7w6v5u4t3s2r1"}{ "proof_id": "prf_01j9z8x7w6v5u4t3s2r1", "timestamp": "2026-04-07T14:32:00Z", "sha256": "a3f8c2d1e4b5...", "verification_url": "https://trust.arkforge.tech/verify/prf_01j9z8x7w6v5u4t3s2r1", "article": "EU AI Act Art. 12"}{ "hotspots": [ { "file": "src/hiring_model.py", "eu_ai_act_risk": "high", "gdpr_risk": "high", "overlap_patterns": ["AI+PII", "AI+automated_decision"], "combined_articles": ["EU AI Act Art. 14", "GDPR Art. 22"], "priority": "critical" } ], "key_insight": "2 files require simultaneous GDPR + EU AI Act remediation"}# Step 1: Generate Annex IV package and certify itgenerate_annex4_package( project_path="/path/to/project", sign_with_trust_layer=True, trust_layer_key="your_trust_layer_key")# → Returns proof_id + public verification URL for your auditor
# Step 2: Or certify any compliance report directlycertify_compliance_report( report_data='{"compliance_percentage": 87, "risk_category": "high"}', trust_layer_key="your_trust_layer_key")python3 paywall_api.py# Listening on 0.0.0.0:8091curl -X POST https://arkforge.tech/mcp/api/v1/scan \ -H "Content-Type: application/json" \ -d '{"project_path": "/path/to/your/project"}'STRIPE_LIVE_SECRET_KEY=sk_live_...STRIPE_WEBHOOK_SECRET=whsec_...TRUST_LAYER_INTERNAL_SECRET=<random-64-char-hex>SMTP_HOST=ssl0.ovh.net[email protected]IMAP_PASSWORD=...Agent Client → Trust Layer → EU AI Act Scanner pays certifies delivers