{
  "markdown": "# Legalithm — EU AI Act compliance in your coding loop\n\n[![npm version](https://img.shields.io/npm/v/legalithm.svg)](https://www.npmjs.com/package/legalithm)\n[![Add to Cursor](https://img.shields.io/badge/Add%20to-Cursor-000000?logo=cursor)](cursor://anysphere.cursor-deeplink/mcp/install?name=legalithm&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImxlZ2FsaXRobS1tY3Atc2VydmVyIl19)\n\nShipping an AI feature to EU users? **Article 50 transparency duties have applied since 2 August 2026.** Content marking for systems placed before that date is due 2 December 2026, and Annex III high-risk obligations follow on 2 December 2027. Catch it where you code, in seconds.\n\n<img src=\"docs/assets/hero.png\" alt=\"Source code on the left, connected by four branching lines to a sealed legal document on the right.\" width=\"100%\">\n\n<sub>This image is AI-generated, and it is marked as such with our own tool: `legalithm mark --watermark` added a C2PA content credential and a pixel watermark, which is what Article 50(2) asks for. Download it and run `legalithm verify` on it. The credential is signed with the CLI's test certificate, so it is valid but not trust-listed.</sub>\n\n## Quickstart\n\nInstall the offline server in your editor. No API key, and nothing leaves your machine.\n\n```bash\nclaude plugin marketplace add legalithm-org/legalithm\nclaude plugin install legalithm@legalithm\n```\n\nCodex:\n\n```bash\ncodex plugin marketplace add legalithm-org/legalithm\ncodex plugin add legalithm@legalithm\n```\n\nCursor: use the **Add to Cursor** badge above.\n\nThen ask your agent *\"does the EU AI Act apply to this feature, and what tier?\"*\n\n<details open>\n<summary>What comes back (real output, CV screening as the provider)</summary>\n\n```json\n{\n  \"risk\": \"high\",\n  \"confidence\": \"high\",\n  \"rationale\": \"This AI system is classified as high-risk under Article 6(2) as it falls into the category of Employment, Workers Management and Access to Self-employment as specified in Annex III...\",\n  \"citations\": [\n    {\n      \"article\": \"6(2)\",\n      \"annex\": \"III\",\n      \"label\": \"Article 6(2) & Annex III - High-Risk AI Systems\",\n      \"url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#article-6\",\n      \"asOf\": \"2026-08-03\",\n      \"appliesFrom\": \"2027-12-02\"\n    }\n  ],\n  \"matchedRules\": [\"high_risk_employment\", \"high_risk_domain_selected\"],\n  \"applicableDeadline\": \"2027-12-02\",\n  \"obligationsHint\": {\n    \"count\": 10,\n    \"topTitles\": [\n      \"Quality Management System (Article 17)\",\n      \"Data Governance (Article 10)\",\n      \"Technical Documentation (Article 11)\",\n      \"Human Oversight (Article 14)\"\n    ]\n  },\n  \"confidenceScore\": 0.72,\n  \"reviewRequired\": false\n}\n```\n\nNote `matchedRules`, `asOf` and `confidenceScore`. You can see which rule fired, how old the corpus is, and how sure the engine was. Below the abstention threshold it sets `reviewRequired` and tells you to get a human instead of guessing.\n\n</details>\n\nContent marking for Article 50(2), also no key:\n\n```bash\nnpm i -g legalithm\nlegalithm mark ./out.png --watermark   # writes out.signed.png\nlegalithm verify ./out.signed.png      # detect both layers\n```\n\nInstall it rather than using `npx` for these two: C2PA and the watermark come from `c2pa-node` and `sharp`, which are optional native dependencies that `npx` does not reliably fetch. Without them `mark` warns and marks nothing. Everything else in this README works fine under `npx`.\n\n### The compliance record (needs a free key)\n\n```bash\nnpx legalithm setup   # wires hooks, editor rule and MCP config\nnpx legalithm init    # writes a dated, cited compliance/legalithm.json\nnpx legalithm check   # re-verify; non-zero exit on drift (for CI)\n```\n\n`init` and `check` talk to the hosted record service, so they need a free API key. Everything above this line does not.\n\n## Three surfaces\n\n1. **Editor** — an offline MCP server (`legalithm-mcp-server`) exposing 4 tools (`classify`, `explain_obligation`, `generate_disclosure`, `check_record`). No API key. The first three run fully offline; `check_record` reads a public API.\n2. **Repo** — `legalithm init` writes a dated, cited `compliance/legalithm.json` that records your AI system's risk tier and the obligations behind it.\n3. **CI** — `legalithm check` and the GitHub Action fail the build when the committed record drifts — because your app changed or the law changed under you.\n\n## MCP config\n\nAdd the offline server to Claude Code, Cursor or Codex manually:\n\n```json\n{\n  \"mcpServers\": {\n    \"legalithm\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"legalithm-mcp-server\"]\n    }\n  }\n}\n```\n\n## GitHub Action\n\n```yaml\n# .github/workflows/ai-act.yml\nname: AI Act\non: [pull_request]\njobs:\n  ai-act:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: legalithm-org/legalithm/packages/action@v1\n        with:\n          api-key: ${{ secrets.LEGALITHM_API_KEY }}\n```\n\n## Honest framing\n\n**A cited starting point that tells you when to get a human — not legal advice.** When unsure, it flags the result for review instead of guessing. Every output is checked against Regulation (EU) 2024/1689; it is not a certification.\n\n## Links\n\n- Full docs: https://www.legalithm.com/en/developers/docs\n- Landing: https://www.legalithm.com/en/developers\n\n## License\n\nMIT\n",
  "bytes": 5285,
  "sha": "b8760ae0b1eaf9fd414ca909089cbdba2a210e30ca0a7d965899cdd9043040f6",
  "repo_slug": "legalithm/legalithm",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_legalithm_legalithm_mcp_server_2c0274b8/readme"
}