Purpose
mcp-eu-ai-act is an open-source tool that provides both a CLI and an MCP server for detecting potential violations of the EU Artificial Intelligence Act (EU AI Act) in codebases. It is officially described as "one command, zero configuration," capable of generating a complete EU AI Act + GDPR compliance report within 10 seconds, mapping findings to binding legal provisions, and returning pass/fail results along with remediation instructions.
Main Capabilities
1. Scanning and Compliance Checks
- scan_project: Detects AI framework usage in source code and configuration/manifest files, supporting 16 frameworks across languages such as Python, JS, TS, Go, Java, and Rust.
- check_compliance: Scores the quality of document content from 0-100 and maps each finding to a specific EU AI Act provision. A score of ≥40 is considered a pass. Supports the risk_category parameter (default limited).
2. Risk Classification and Roadmap
- suggest_risk_category: Based on a plain-text description, classifies an AI system into an EU AI Act risk category, matching Art. 5 (prohibited), Annex III (high-risk), Art. 52 (limited risk), and minimal risk.
- generate_compliance_roadmap (new in v2): Generates a deadline-oriented, week-by-week action plan to help achieve compliance before August 2, 2026. Uses a "criticality × 1/effort" algorithm to prioritize quick wins.
3. Reports and Templates
- generate_report: Runs scanning + compliance checks and returns a combined report, including an executive summary for DPOs/legal and technical details for developers, with article-by-article citations.
- generate_compliance_templates: Returns Markdown starter templates for various required compliance documents. The high-risk category covers risk management (Art. 9), technical documentation (Art. 11), data governance (Art. 10), human oversight (Art. 14), robustness (Art. 15), and transparency (Art. 13).
- generate_annex4_package (new in v2): Generates an audit-readyZIP package based on actual project files, populating all 8 sections of Annex IV, with the option to perform encrypted certification via the Trust Layer.
4. GDPR and Combined Compliance
- gdpr_scan_project: Scans for personal data processing patterns, such as PII fields, tracking pixels, geolocation, file uploads, and cookie patterns, and maps them to GDPR Art. 22/35 requirements.
- combined_compliance_report: Runs both GDPR and EU AI Act scans and identifies "dual compliance hotspot" files where both apply simultaneously.
5. Report Certification
- certify_compliance_report (new in v2): Certifies any compliance report via the ArkForge Trust Layer, returning a tamper-proof proof_id and a public verification URL for EU AI Act Art. 12 audit trails.
Usage
CLI
After installation, you can scan the current project directly or specify a path: eu-ai-act-scanner /path/to/your/project
Record long-term compliance (free): eu-ai-act-scanner . --register you@email.com
MCP Server
Official recommendation is to install from PyPI. It can be added as an MCP integration to claude_desktop_config.json or .cursor/mcp.json. HTTP mode is also supported for CI/CD or remote clients.
REST API
There is also a separate HTTP API (paywall_api.py) that provides rate-limited REST endpoints for CI/CD and external clients.
Use Cases
- Development teams self-checking their codebases for AI Act risks before submission.
- Compliance/legal teams obtaining DPO-oriented executive summaries and article citations.
- Audit preparation, generating Annex IV packages and verifiable compliance evidence.
- Integrating compliance gate checks into CI/CD pipelines (officially planned v3 feature).
Limitations
- Only performs static analysis, detecting imports and patterns, not runtime behavior.
- Cannot automatically determine risk category from code alone; suggest_risk_c must be usedategory and enter a description.
- check_compliance evaluates content quality; documents containing boilerplate text or placeholders will receive a lower score.
- File scanning is limited to 5,000 files, 1 MB per file.
- For security reasons, some system paths are prohibited from being scanned.
Pricing and Versions
- Free tier: no registration required, no API key required, scan after pip install. The REST free tier allows 5 scans per IP per day.
- Pro tier: unlimited scans, use the X-API-Key request header, 29 EUR/month.
- Trust Layer free account: 500 attestations per month.
Planned v3 Features
- GPAI obligations module (Art. 51-55, July 2025 code of conduct).
- GitHub Action for CI/CD compliance gates.
- Runtime agent compliance enforcement (Art. 14).
