{
  "markdown": "# eu-audit-mcp\n\n<!-- mcp-name: io.github.jellewas/eu-audit-mcp -->\n\nTamper-evident audit trail MCP server for EU AI Act and GDPR compliance. Designed to be integrated into a local desktop application via stdio transport.\n\n## Features\n\n- **Tamper-evident logging** — HMAC-SHA256 hash chain over all events\n- **PII scanning** — Automatic detection and redaction via Microsoft Presidio (EU patterns)\n- **GDPR erasure** — Article 17 right-to-erasure support with audit trail\n- **Compliance checks** — Technical checklist against EU AI Act Articles 12/19 and GDPR Article 30\n- **Local-first** — All data stays on your machine in a single SQLite file\n\n## Regulatory context\n\nThis server implements technical measures for the following EU regulations:\n\n| Regulation | Articles | What it requires |\n|---|---|---|\n| **EU AI Act** (2024/1689) | [Art. 12](https://artificialintelligenceact.eu/article/12/) | Automatic recording of events (logs) for high-risk AI systems |\n| | [Art. 19](https://artificialintelligenceact.eu/article/19/) | Retention of automatically generated logs for at least 6 months |\n| **GDPR** (2016/679) | [Art. 17](https://gdpr.eu/article-17-right-to-be-forgotten/) | Right to erasure of personal data (\"right to be forgotten\") |\n| | [Art. 30](https://gdpr.eu/article-30-records-of-processing-activities/) | Records of processing activities, including purposes and data categories |\n\nThe EU AI Act high-risk obligations enter into force on **2 August 2026**.\n\nSee [LEGAL_REFERENCES.md](LEGAL_REFERENCES.md) for the full article texts and a detailed mapping of how each tool addresses each requirement.\n\n> **Disclaimer:** This tool provides a technical checklist, not legal advice. Consult qualified legal counsel for compliance decisions.\n\n## Quick start\n\n```bash\npip install -e \".[dev]\"\n```\n\n### Run the server (stdio)\n\n```bash\npython -m eu_audit_mcp.server\n```\n\n### MCP client configuration\n\n```json\n{\n  \"mcpServers\": {\n    \"eu-audit\": {\n      \"command\": \"python\",\n      \"args\": [\"-m\", \"eu_audit_mcp.server\"],\n      \"env\": {\n        \"AUDIT_CONFIG\": \"./audit_config.yaml\"\n      }\n    }\n  }\n}\n```\n\n### Run tests\n\n```bash\npytest tests/\n```\n\n## MCP Tools\n\n| Tool | Description |\n|------|-------------|\n| `log_event` | Record an audit event with automatic PII scanning |\n| `log_inference` | Log an LLM inference call (model, tokens, cost) |\n| `log_data_access` | Log a document/data access event |\n| `query_log` | Search events by time range, type, session |\n| `get_session_trace` | Full ordered trace of a session |\n| `get_stats` | Summary statistics over a time period |\n| `compliance_check` | Check against EU AI Act Art. 12/19 and GDPR Art. 30 |\n| `execute_erasure` | GDPR Article 17 right-to-erasure |\n| `get_pii_summary` | Summary of detected PII types (counts only) |\n| `verify_chain` | Verify hash chain integrity |\n\n## Configuration\n\nCopy the example config and customize:\n\n```bash\ncp audit_config.example.yaml audit_config.yaml\n```\n\nSet the `AUDIT_CONFIG` environment variable to point to your config file. **Do not commit `audit_config.yaml`** if it contains a `chain_secret` — it is in `.gitignore` by default.\n\n## Security\n\nSee [SECURITY.md](SECURITY.md) for the threat model, security measures, and vulnerability reporting.\n\n## License\n\nApache-2.0\n",
  "bytes": 3271,
  "sha": "08f17d7641228603dc640ecd05d7b8ba58b114adde14204a220de569117e0557",
  "repo_slug": "jellewas/eu-audit-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_jellewas_eu_audit_mcp_dc6455dd/readme"
}