Compliance MCP server

What it does

An MCP server that exposes GDPR and EU AI Act compliance rules, implementation checklists, and tracking workflows. It helps engineers and AI agents determine what regulations apply to their systems, retrieve applicable requirements, and submit evidence of compliance efforts.

• Determine whether GDPR or the EU AI Act applies to your system by answering scoping questions with source citations.
• Retrieve prioritized implementation checklists and engineering requirements for specific features like data export under GDPR.
• Submit evidence signals and filenames to track compliance work and generate audit reports without uploading source code.

Tools this server exposes

Tool	Does
list_regulations	List regulations available on your RuleMesh plan.
list_frameworks	List compliance frameworks available.
lookup_definition	Look up the definition of a regulatory term.
get_compliance_plan	Generate a prioritized compliance implementation plan.
scope_next_question	Get the next scoping question to determine regulatory applicability.
scope_classify	Classify a system to determine applicable regulations.
scope_retrieve_source	Retrieve source provisions backing a scoping result.
scope_query_applicable	Query which regulations apply to a system.
scope_update_profile	Update the system profile used for scoping.
pull_rules	Retrieve compliance rules and implementation checklists for a specific feature or requirement.
scan_compliance	Scan a repository against pulled compliance requirements.
submit_signals	Submit a single evidence signal for a compliance requirement.
submit_signals_batch	Submit multiple evidence signals at once.
get_progress	Get the current compliance progress and status.
get_ticket_status	Get the status of a compliance ticket or submission.
get_scan_sessions	List scan sessions and their results.
start_scan	Start a new compliance scanning session.
end_scan	End the current compliance scanning session.
resume_session	Resume a previously paused compliance session.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.