Legalithm Mcp Server

io.github.legalithmPublished by GitHub account legalithmv0.1.2Updated Oct 24, 2026

EU AI Act compliance in your editor: classify risk, cite obligations, draft Article 50 text.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

An offline MCP server that helps an assistant classify an AI feature's EU AI Act risk tier, cite obligations, and draft Article 50 transparency text.

What you can do
Classify an AI system's EU AI Act risk tier with cited articles and annexes, matched rules, confidence score and applicable deadline, flagging results for human review when unsure. Explain the obligations behind a classification, including counts and top obligation titles. Draft Article 50 disclosure text for AI-generated content. Check a compliance record against a public API.
When to use it
Useful when shipping an AI feature to EU users and you want a quick, cited starting point on risk tier and transparency duties inside the editor, or when drafting Article 50 disclosure text. It is a cited starting point, not legal advice or certification.
Requirements
Runs locally over stdio, typically via npx with the npm package legalithm-mcp-server; no API key is needed for the offline tools. The check_record tool reads a public API, so it needs network access. The separate CLI's mark and verify commands need optional native dependencies.
Before you install
Outputs are a cited starting point, not legal advice, and are not a certification; results below the abstention threshold are flagged for human review. The check_record tool contacts a public API. The separate CLI's init and check commands need a free API key and talk to a hosted record service; the GitHub Action example passes a key as a secret.

Installation

In SourceWeft

  1. Open Legalithm Mcp Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Legalithm — EU AI Act compliance in your coding loop

[npm version] [Add to Cursor]

Shipping an AI feature to EU users? Article 50 transparency duties have applied since 2 August 2026. Content marking for systems placed before that date is due 2 December 2026, and Annex III high-risk obligations follow on 2 December 2027. Catch it where you code, in seconds.

[Source code on the left, connected by four branching lines to a sealed legal document on the right.]

This image is AI-generated, and it is marked as such with our own tool: legalithm mark --watermark added a C2PA content credential and a pixel watermark, which is what Article 50(2) asks for. Download it and run legalithm verify on it. The credential is signed with the CLI's test certificate, so it is valid but not trust-listed.

Quickstart

Install the offline server in your editor. No API key, and nothing leaves your machine.

bash
claude plugin marketplace add legalithm-org/legalithmclaude plugin install legalithm@legalithm

Codex:

bash
codex plugin marketplace add legalithm-org/legalithmcodex plugin add legalithm@legalithm

Cursor: use the Add to Cursor badge above.

Then ask your agent "does the EU AI Act apply to this feature, and what tier?"

What comes back (real output, CV screening as the provider)
json
{  "risk": "high",  "confidence": "high",  "rationale": "This AI system is classified as high-risk under Article 6(2) as it falls into the category of Employment, Workers Management and Access to Self-employment as specified in Annex III...",  "citations": [    {      "article": "6(2)",      "annex": "III",      "label": "Article 6(2) & Annex III - High-Risk AI Systems",      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#article-6",      "asOf": "2026-08-03",      "appliesFrom": "2027-12-02"    }  ],  "matchedRules": ["high_risk_employment", "high_risk_domain_selected"],  "applicableDeadline": "2027-12-02",  "obligationsHint": {    "count": 10,    "topTitles": [      "Quality Management System (Article 17)",      "Data Governance (Article 10)",      "Technical Documentation (Article 11)",      "Human Oversight (Article 14)"    ]  },  "confidenceScore": 0.72,  "reviewRequired": false}

Note matchedRules, asOf and confidenceScore. You can see which rule fired, how old the corpus is, and how sure the engine was. Below the abstention threshold it sets reviewRequired and tells you to get a human instead of guessing.

Content marking for Article 50(2), also no key:

bash
npm i -g legalithmlegalithm mark ./out.png --watermark   # writes out.signed.pnglegalithm verify ./out.signed.png      # detect both layers

Install it rather than using npx for these two: C2PA and the watermark come from c2pa-node and sharp, which are optional native dependencies that npx does not reliably fetch. Without them mark warns and marks nothing. Everything else in this README works fine under npx.

The compliance record (needs a free key)

bash
npx legalithm setup   # wires hooks, editor rule and MCP confignpx legalithm init    # writes a dated, cited compliance/legalithm.jsonnpx legalithm check   # re-verify; non-zero exit on drift (for CI)

init and check talk to the hosted record service, so they need a free API key. Everything above this line does not.

Three surfaces

  1. Editor — an offline MCP server (legalithm-mcp-server) exposing 4 tools (classify, explain_obligation, generate_disclosure, check_record). No API key. The first three run fully offline; check_record reads a public API.
  2. Repo — legalithm init writes a dated, cited compliance/legalithm.json that records your AI system's risk tier and the obligations behind it.
  3. CI — legalithm check and the GitHub Action fail the build when the committed record drifts — because your app changed or the law changed under you.

MCP config

Add the offline server to Claude Code, Cursor or Codex manually:

json
{  "mcpServers": {    "legalithm": {      "command": "npx",      "args": ["-y", "legalithm-mcp-server"]    }  }}

GitHub Action

yaml
# .github/workflows/ai-act.ymlname: AI Acton: [pull_request]jobs:  ai-act:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: legalithm-org/legalithm/packages/action@v1        with:          api-key: ${{ secrets.LEGALITHM_API_KEY }}

Honest framing

A cited starting point that tells you when to get a human — not legal advice. When unsure, it flags the result for review instead of guessing. Every output is checked against Regulation (EU) 2024/1689; it is not a certification.

Links

License

MIT

Source: README.md at commit 4c5717e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts