Mydatapass

io.github.mydatapassPublished by GitHub account mydatapassv0.1.0Updated Oct 24, 2026

Neutral escrow for customer-data offboarding (GDPR/EU Data Act): query MyDataPass facts.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

A remote MCP server that answers questions about MyDataPass, a neutral escrow service for customer-data offboarding under GDPR and the EU Data Act.

What you can do
Explain what MyDataPass is, the category it defines and who it serves, plus how to verify a delivery certificate offline and what the offboarding flow delivers to the client.
When to use it
Use it when evaluating MyDataPass as an offboarding or escrow provider, comparing its products and public prices, or checking how it relates to a named privacy regulation such as GDPR or the EU Data Act.
Requirements
A remote streamable HTTP endpoint; no package, account, API key or environment variable is declared.
Before you install
It is a read-only informational server about one vendor's own offering, so treat its answers as vendor material rather than independent advice. It does not decrypt or verify exports itself; that is done with separate offline tooling and a passphrase.

Installation

In SourceWeft

  1. Open Mydatapass in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.mydatapass%2Fmydatapass/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "mydatapass": {
      "type": "http",
      "url": "https://mcp.mydatapass.app/api/mcp"
    }
  }
}

README

mydatapass-verify

Independently verify a MyDataPass export — without trusting us.

MyDataPass delivers customer data offboarding exports as encrypted, audit-logged packages. This repository contains everything a recipient (or their security team) needs to decrypt and verify an export with zero MyDataPass involvement: the package format specification and two standalone verifiers.

Why this repo exists

Our security model does not rely on secrecy of the format — it relies on the strength of the passphrase and standard, auditable cryptography. Publishing the format and the verification tooling means:

  • Your security team can review exactly how packages are encrypted before signing anything.
  • Recipients can decrypt and verify integrity offline, with no MyDataPass servers involved.
  • If MyDataPass disappeared tomorrow, every delivered package would remain fully recoverable with the passphrase and this tooling.

Transparency log: retention and closure commitment

Every signed certificate's SHA-256 fingerprint is appended to the public transparency log at mydatapass.app/transparency. The log holds hashes only, no customer data.

  • Retention: each log entry is kept for at least 5 years from the date it was added, and for as long as MyDataPass operates.
  • If MyDataPass ceases operations: we will publish a final copy of the complete log in a public archive (this repository, or a public archive linked from it), so every certificate remains checkable against the log without us.

The full certificate record (with the names of the parties) is kept for a fixed period per service and then reduced to its hash; the periods are in our Terms (§ 8) and DPA (Annex 1). A signed certificate stays verifiable offline with its signature, qualified time stamp and anchor, so keep your own copy.

What's in an export package

A MyDataPass package is a JSON file with four fields:

FieldDescription
ciphertext_b64AES-256-GCM ciphertext, Base64
iv_b6412-byte random nonce, Base64
salt_b6416-byte random KDF salt, Base64
hash_sha256SHA-256 hex digest of the original plaintext

Encryption: AES-256-GCM. Key derivation: PBKDF2-HMAC-SHA256, 310,000 iterations, 32-byte key. Full details in docs/export-format.md.

Verify an export

Option A — browser, fully offline

Open verify.html in any modern browser (works from file://, no network requests are made). Select the package file, enter the passphrase, and the page decrypts via WebCrypto and checks the SHA-256 digest locally.

Option B — command line

Requires Python 3.9+ and the cryptography package:

bash
pip install cryptographypython verify.py package.json --out exported-data.bin

The script prompts for the passphrase, decrypts, and confirms the plaintext digest matches hash_sha256. Exit code 0 means the package is authentic and intact; any tampering with the ciphertext fails GCM authentication.

What this repo is NOT

This is not the MyDataPass product source code. It is the public, auditable surface: the delivery format, the verification tooling, and our security model. Questions or responsible disclosure: [email protected].

License

MIT — see LICENSE.

Source: README.md at commit 0775972

Tools

5

about_mydatapass

What MyDataPass is, the category it defines, and who it is for.

Takes no parameters.

get_pricing

MyDataPass products and public prices: Exit, Exit Evidence Sprint, Exit-Ready and Enclave.

Takes no parameters.

check_compliance_requirement

Check how MyDataPass relates to a data/privacy regulation (e.g. 'GDPR', 'EU Data Act', 'Article 20').

Parametersregulationrequired

get_offboarding_guide

The step-by-step offboarding flow and what the client ultimately receives.

Takes no parameters.

verify_certificate

Explain how to independently verify a MyDataPass delivery certificate (offline).

Parameterstoken

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts