EU Audit Trail

io.github.jellewasPublished by GitHub account jellewasv0.1.1Updated Oct 24, 2026

Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

The publisher's own server: audit.domains - Domain Valuation

VerifiedSTDIODesktop onlySecurity & MonitoringData & Analytics

Overview

AI-generated overview

A local MCP server that records tamper-evident audit events, scans for PII, and checks EU AI Act and GDPR compliance.

What you can do
Record audit events, LLM inference calls and data access events, with automatic PII scanning and redaction on each entry. Search and review the log by time range, type or session, and pull a full ordered trace of a session. Get summary statistics and counts of detected PII types over a period. Run a technical compliance checklist against EU AI Act Articles 12/19 and GDPR Article 30. Execute a GDPR Article 17 erasure and verify the integrity of the HMAC-SHA256 hash chain.
When to use it
Useful when you need a local, tamper-evident record of AI activity for EU AI Act or GDPR documentation, such as logging high-risk system events, tracking inference calls, or preparing records of processing activities. It suits teams that want technical evidence on their own machine rather than a hosted logging service.
Requirements
Runs as a local process over stdio, installed from the PyPI package eu-audit-mcp (Python). Needs a YAML configuration file whose path is set in the AUDIT_CONFIG environment variable. Data is stored in a local SQLite file. No authentication is declared.
Before you install
The configuration file may hold a chain_secret used for the hash chain; the README warns not to commit it. Erasure and logging tools write to and remove data from the local audit store, so use them deliberately. The project states it is a technical checklist, not legal advice. PII scanning relies on Microsoft Presidio, and all data stays local.

Installation

In SourceWeft

  1. Open EU Audit Trail in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

eu-audit-mcp

Tamper-evident audit trail MCP server for EU AI Act and GDPR compliance. Designed to be integrated into a local desktop application via stdio transport.

Features

  • Tamper-evident logging — HMAC-SHA256 hash chain over all events
  • PII scanning — Automatic detection and redaction via Microsoft Presidio (EU patterns)
  • GDPR erasure — Article 17 right-to-erasure support with audit trail
  • Compliance checks — Technical checklist against EU AI Act Articles 12/19 and GDPR Article 30
  • Local-first — All data stays on your machine in a single SQLite file

Regulatory context

This server implements technical measures for the following EU regulations:

RegulationArticlesWhat it requires
EU AI Act (2024/1689)Art. 12Automatic recording of events (logs) for high-risk AI systems
Art. 19Retention of automatically generated logs for at least 6 months
GDPR (2016/679)Art. 17Right to erasure of personal data ("right to be forgotten")
Art. 30Records of processing activities, including purposes and data categories

The EU AI Act high-risk obligations enter into force on 2 August 2026.

See LEGAL_REFERENCES.md for the full article texts and a detailed mapping of how each tool addresses each requirement.

Disclaimer: This tool provides a technical checklist, not legal advice. Consult qualified legal counsel for compliance decisions.

Quick start

bash
pip install -e ".[dev]"

Run the server (stdio)

bash
python -m eu_audit_mcp.server

MCP client configuration

json
{  "mcpServers": {    "eu-audit": {      "command": "python",      "args": ["-m", "eu_audit_mcp.server"],      "env": {        "AUDIT_CONFIG": "./audit_config.yaml"      }    }  }}

Run tests

bash
pytest tests/

MCP Tools

ToolDescription
log_eventRecord an audit event with automatic PII scanning
log_inferenceLog an LLM inference call (model, tokens, cost)
log_data_accessLog a document/data access event
query_logSearch events by time range, type, session
get_session_traceFull ordered trace of a session
get_statsSummary statistics over a time period
compliance_checkCheck against EU AI Act Art. 12/19 and GDPR Art. 30
execute_erasureGDPR Article 17 right-to-erasure
get_pii_summarySummary of detected PII types (counts only)
verify_chainVerify hash chain integrity

Configuration

Copy the example config and customize:

bash
cp audit_config.example.yaml audit_config.yaml

Set the AUDIT_CONFIG environment variable to point to your config file. Do not commit audit_config.yaml if it contains a chain_secret — it is in .gitignore by default.

Security

See SECURITY.md for the threat model, security measures, and vulnerability reporting.

License

Apache-2.0

Source: README.md at commit 3a22ddf

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Business & Commerce27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Developer Tools2 toolsOct 24, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth
Data & AnalyticsCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only
AI & MLNot validated yetNov 7, 2026

Mcp Supply Audit

Published by GitHub account kimmawla

Audits MCP servers as supply-chain artifacts — registry entries, PyPI/npm packages, client configs and tool definitions — using read-only static checks.

STDIODesktop only
Developer ToolsNot validated · the package did not installNov 5, 2026