{
  "markdown": "# klaws\n\n[![CI](https://github.com/rostradamus/klaws/actions/workflows/ci.yml/badge.svg)](https://github.com/rostradamus/klaws/actions/workflows/ci.yml)\n[![Release](https://img.shields.io/github/v/release/rostradamus/klaws)](https://github.com/rostradamus/klaws/releases/latest)\n[![Container](https://img.shields.io/badge/ghcr.io-rostradamus%2Fklaws-blue?logo=docker)](https://github.com/rostradamus/klaws/pkgs/container/klaws)\n[![Glama](https://glama.ai/mcp/servers/rostradamus/klaws/badges/score.svg)](https://glama.ai/mcp/servers/rostradamus/klaws)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\n[한국어](README.ko.md)\n\nKorean law compliance risk scanner for codebases. Scans source code for patterns that may indicate compliance risks under Korean law and maps findings to specific legal provisions. Runs as an [MCP](https://modelcontextprotocol.io/) server (so AI coding assistants can scan on request) and as a standalone CLI.\n\nCurrently covers [PIPA](https://www.law.go.kr/법령/개인정보보호법) (Personal Information Protection Act), the [Network Act](https://www.law.go.kr/법령/정보통신망이용촉진및정보보호등에관한법률) (정보통신망법), the [Credit Information Act](https://www.law.go.kr/법령/신용정보의이용및보호에관한법률) (신용정보법), and the [E-Commerce Act](https://www.law.go.kr/법령/전자상거래등에서의소비자보호에관한법률) (전자상거래법).\n\n> **Disclaimer:** klaws identifies possible compliance risks for review. It does not constitute legal advice. Consult qualified legal counsel for definitive guidance.\n\n> **Privacy:** klaws analyzes code **locally** and transmits nothing. The only outbound network call is the optional `--live` law lookup to [law.go.kr](https://www.law.go.kr); without that flag it is fully offline. See [Privacy & Security](#privacy--security).\n\n## Quick Start\n\n```bash\n# Scan the current directory with Docker — no install needed\ndocker run --rm -v \"$PWD\":/src:ro ghcr.io/rostradamus/klaws scan /src\n\n# ...or, if you installed the binary:\nklaws scan ./my-project        # scan a directory\nklaws scan ./MyService.java    # scan a single file\n```\n\n## Installation\n\n### Docker (recommended)\n\nNo toolchain required — the image is published to GitHub Container Registry and works identically on macOS, Linux, and Windows:\n\n```bash\n# Scan the current directory (mount it read-only at /src)\ndocker run --rm -v \"$PWD\":/src:ro ghcr.io/rostradamus/klaws scan /src\n\n# Pin a version instead of the floating latest tag\ndocker run --rm -v \"$PWD\":/src:ro ghcr.io/rostradamus/klaws:0.1.6 scan /src\n```\n\n### Prebuilt binary\n\nDownload the archive for your platform from the [latest release](https://github.com/rostradamus/klaws/releases/latest), extract it, and move `klaws` onto your `PATH`.\n\n### go install\n\n```bash\ngo install github.com/rostradamus/klaws/cmd/klaws@latest\n```\n\n### From source\n\n**Requirements:** Go 1.23+\n\n```bash\ngit clone https://github.com/rostradamus/klaws.git\ncd klaws\ngo build -o klaws ./cmd/klaws/\n```\n\nVerify the install:\n\n```bash\nklaws --version\n```\n\n## Usage\n\n### Scan\n\n```bash\n# Scan a directory (default: *.java files)\nklaws scan ./src\n\n# Scan specific file types\nklaws scan ./src --pattern \"*.kt\"\n\n# Text output (default is JSON)\nklaws scan ./src --format text\n\n# SARIF output (for GitHub code scanning / other tools)\nklaws scan ./src --format sarif > klaws.sarif\n\n# Fail the command (exit 1) if any finding is at or above a severity\nklaws scan ./src --fail-on HIGH\n\n# Use a custom laws file\nklaws scan ./src --laws ./my-laws.yaml\n```\n\n### Example Output\n\n```\nklaws scan report\nTarget:  ./testdata\nFiles:   4\nFindings: 7\n\n--- Finding 1 ---\n  Detector:  PIPA-CST-001\n  Risk:      HIGH\n  Location:  testdata/MemberController.java:10\n  Snippet:   @PostMapping(\"/register\")\n  Message:   Endpoint accepts possible personal data without apparent consent\n             mechanism — may require review under PIPA Article 15\n  Laws:      PIPA-15\n\n--- Finding 2 ---\n  Detector:  PIPA-ENC-001\n  Risk:      HIGH\n  Location:  testdata/MemberEntity.java:11\n  Snippet:   private String residentNumber;\n  Message:   Possible unencrypted personal identifier (residentNumber) — may\n             require review under PIPA Article 24-2\n  Laws:      PIPA-24-2, PIPA-29\n\n--- Finding 3 ---\n  Detector:  PIPA-LOG-001\n  Risk:      MEDIUM\n  Location:  testdata/UserService.java:11\n  Snippet:   log.info(\"User registered: \" + email);\n  Message:   Possible personal data (email) in log output — may require review\n             under PIPA Article 29\n  Laws:      PIPA-29\n```\n\n### Look Up Law Provisions\n\n```bash\n# Look up from bundled database\nklaws law PIPA-15\n\n# Fetch live text from law.go.kr\nklaws law PIPA-15 --live\n```\n\n### List Detectors\n\n```bash\nklaws detectors\n```\n\n```json\n[\n  {\n    \"id\": \"PIPA-LOG-001\",\n    \"name\": \"Personal Data Logging Risk\",\n    \"description\": \"Detects log statements that may contain personal data fields\",\n    \"related_laws\": [\"PIPA-29\"]\n  },\n  {\n    \"id\": \"PIPA-ENC-001\",\n    \"name\": \"Unencrypted Personal Data Risk\",\n    \"description\": \"Detects personal identifier fields stored without apparent encryption\",\n    \"related_laws\": [\"PIPA-24-2\", \"PIPA-29\"]\n  },\n  {\n    \"id\": \"PIPA-CST-001\",\n    \"name\": \"Missing Consent Check Risk\",\n    \"description\": \"Detects endpoints accepting personal data without apparent consent verification\",\n    \"related_laws\": [\"PIPA-15\"]\n  }\n]\n```\n\n## Detectors\n\n| ID | Name | What it looks for | Risk | Related Law |\n|----|------|-------------------|------|-------------|\n| `PIPA-LOG-001` | Personal Data Logging | `log.*()` calls containing personal data field names (email, phone, SSN, password) | MEDIUM | PIPA Art. 29 |\n| `PIPA-ENC-001` | Unencrypted Personal Data | Sensitive identifier fields (resident number, SSN) without encryption annotations or calls | HIGH | PIPA Art. 24-2, 29 |\n| `PIPA-CST-001` | Missing Consent Check | `@PostMapping`/`@PutMapping` endpoints accepting personal data without consent verification | HIGH | PIPA Art. 15 |\n| `NIA-MKT-001` | Marketing Message Consent | Advertising/marketing message dispatch (`send`/`push`) without an apparent opt-in consent check | MEDIUM | Network Act Art. 50 |\n| `CIA-ENC-001` | Unprotected Credit Information | Credit/financial identifier fields (card number, account number, credit score) without encryption or masking | HIGH | Credit Information Act Art. 19 |\n| `ECA-RET-001` | Transaction Record Retention | Transaction record fields (order/payment IDs) stored without apparent retention or preservation handling | MEDIUM | E-Commerce Act Art. 6 |\n| `PIPA-RET-001` | Personal Data Retention | Personal data fields (email, phone, resident number) stored without apparent destruction or retention-limit handling | MEDIUM | PIPA Art. 21 |\n| `PIPA-XBR-001` | Third-Party Data Transfer | Personal data sent to a third-party or external endpoint (outbound call to an external URL/partner) without an apparent consent check | HIGH | PIPA Art. 17 |\n\nDetectors use regex-based pattern matching. They support both English and Korean field names (e.g., `email`/`이메일`, `residentNumber`/`주민번호`, `consent`/`동의`).\n\n## MCP Server\n\nklaws can run as an [MCP](https://modelcontextprotocol.io/) server, making its scanning capabilities available to AI coding assistants.\n\n```bash\nklaws serve\n```\n\n### Available Tools\n\n| Tool | Description |\n|------|-------------|\n| `scan_directory` | Scan a directory for compliance risks |\n| `scan_file` | Scan a single file |\n| `list_detectors` | List all available detectors |\n| `get_law_reference` | Look up a Korean law provision by ID |\n\n### Configuration\n\nAll clients use the same launch command: `klaws serve` over stdio. Use the absolute path to the binary (run `which klaws`, or `where klaws` on Windows, to find it), or just `klaws` if it is on your `PATH`. Prefer not to install anything? Use the [Docker variant](#run-the-mcp-server-via-docker) below — it works in any client that supports stdio MCP servers.\n\n**Claude Code** — `~/.claude/settings.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"klaws\": {\n      \"command\": \"klaws\",\n      \"args\": [\"serve\"]\n    }\n  }\n}\n```\n\nOr add it in one command:\n\n```bash\nclaude mcp add klaws -- klaws serve\n```\n\n**Claude Desktop** — `claude_desktop_config.json` (Settings → Developer → Edit Config):\n\n```json\n{\n  \"mcpServers\": {\n    \"klaws\": {\n      \"command\": \"klaws\",\n      \"args\": [\"serve\"]\n    }\n  }\n}\n```\n\n**Cursor** — `~/.cursor/mcp.json` (or `.cursor/mcp.json` in a project):\n\n```json\n{\n  \"mcpServers\": {\n    \"klaws\": {\n      \"command\": \"klaws\",\n      \"args\": [\"serve\"]\n    }\n  }\n}\n```\n\n**VS Code** — `.vscode/mcp.json`:\n\n```json\n{\n  \"servers\": {\n    \"klaws\": {\n      \"command\": \"klaws\",\n      \"args\": [\"serve\"]\n    }\n  }\n}\n```\n\nOnce connected, ask your assistant something like *\"scan this directory for Korean compliance risks with klaws.\"*\n\n#### Run the MCP server via Docker\n\nNo binary install needed — swap the `command`/`args` for a `docker run` that mounts the code you want scannable. The `-i` flag keeps stdin open for the stdio transport; `--scan-root /src` confines scans to the mounted directory:\n\n```json\n{\n  \"mcpServers\": {\n    \"klaws\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-v\", \"/absolute/path/to/your/project:/src:ro\",\n        \"ghcr.io/rostradamus/klaws:latest\",\n        \"serve\", \"--scan-root\", \"/src\"\n      ]\n    }\n  }\n}\n```\n\nPoint the assistant at paths under `/src` (the container-side mount), e.g. *\"scan /src for Korean compliance risks.\"*\n\n### Remote (Streamable HTTP)\n\nBy default `klaws serve` uses stdio (local). To run it as a remote MCP server over HTTP, pass `--http`:\n\n```bash\nklaws serve --http :8080\n# or via the published container image:\ndocker run --rm -p 8080:8080 ghcr.io/rostradamus/klaws serve --http :8080\n```\n\nThe MCP endpoint is then available at `http://<host>:8080/mcp` (Streamable HTTP transport). Point an HTTP-capable MCP client at that URL.\n\n#### Securing a remote server\n\n```bash\nklaws serve --http :8080 \\\n  --auth-token \"$(openssl rand -hex 32)\" \\\n  --scan-root /workspace\n```\n\n- `--auth-token <token>` — requires `Authorization: Bearer <token>` on every HTTP request; unauthenticated requests get `401`. Can also be supplied via the `KLAWS_AUTH_TOKEN` environment variable. Applies to `--http` only.\n- `--scan-root <dir>` — restricts `scan_directory` / `scan_file` to paths within `<dir>`; requests for paths outside it are rejected. (Also honored in stdio mode.)\n\n> **Notes:**\n> - `--auth-token` provides bearer auth but **not TLS**. For untrusted networks, still terminate TLS at a reverse proxy / gateway in front of klaws.\n> - The `scan_directory` and `scan_file` tools read the **server's** filesystem (the paths you pass resolve on the host running klaws). For remote scanning, run klaws where the code lives (e.g. a CI runner with the repo checked out) and set `--scan-root` to that checkout. The `get_law_reference` and `list_detectors` tools have no filesystem dependency.\n\n## Bundled Law Provisions\n\nklaws ships with 40 articles across 4 Korean laws embedded in the binary (no external files needed):\n\n### PIPA (개인정보 보호법) — 10 articles\n\n| ID | Article | Topic |\n|----|---------|-------|\n| `PIPA-15` | Art. 15 | Collection and use of personal information |\n| `PIPA-17` | Art. 17 | Provision to third parties |\n| `PIPA-18` | Art. 18 | Restriction on use beyond purpose |\n| `PIPA-21` | Art. 21 | Destruction of personal information |\n| `PIPA-23` | Art. 23 | Restriction on sensitive information |\n| `PIPA-24` | Art. 24 | Restriction on unique identification info |\n| `PIPA-24-2` | Art. 24-2 | Restrictions on resident registration numbers |\n| `PIPA-29` | Art. 29 | Duty of safety measures |\n| `PIPA-30` | Art. 30 | Privacy policy |\n| `PIPA-34` | Art. 34 | Notification of data breach |\n\n### Network Act (정보통신망법) — 11 articles\n\n| ID | Article | Topic |\n|----|---------|-------|\n| `NIA-22` | Art. 22 | Consent for collection/use of personal info |\n| `NIA-23` | Art. 23 | Restriction on collection |\n| `NIA-23-2` | Art. 23-2 | Restriction on resident registration numbers |\n| `NIA-24` | Art. 24 | Restriction on use |\n| `NIA-24-2` | Art. 24-2 | Provision to third parties |\n| `NIA-27` | Art. 27 | Safety measures |\n| `NIA-28` | Art. 28 | Entrustment of personal info |\n| `NIA-28-2` | Art. 28-2 | Notification of data breach |\n| `NIA-44` | Art. 44 | User protection |\n| `NIA-44-7` | Art. 44-7 | Prohibition of illegal information |\n| `NIA-50` | Art. 50 | Restriction on transmission of advertising info |\n\n### Credit Information Act (신용정보법) — 10 articles\n\n| ID | Article | Topic |\n|----|---------|-------|\n| `CIA-15` | Art. 15 | Principles of collection |\n| `CIA-17` | Art. 17 | Prohibition of disclosure beyond purpose |\n| `CIA-19` | Art. 19 | Safety of credit info systems |\n| `CIA-20` | Art. 20 | Accuracy and currency of credit info |\n| `CIA-32` | Art. 32 | Consent for provision/use |\n| `CIA-33` | Art. 33 | Use of personal credit info |\n| `CIA-34` | Art. 34 | Provision/use of personal credit info |\n| `CIA-38` | Art. 38 | Protection of credit info |\n| `CIA-39` | Art. 39 | Notification of data breach |\n| `CIA-40` | Art. 40 | Rights of credit info subjects |\n\n### E-Commerce Act (전자상거래법) — 9 articles\n\n| ID | Article | Topic |\n|----|---------|-------|\n| `ECA-6` | Art. 6 | Preservation of transaction records |\n| `ECA-7` | Art. 7 | Prevention of operational errors |\n| `ECA-11` | Art. 11 | Reliability of electronic payment |\n| `ECA-13` | Art. 13 | Provision of identity and transaction info |\n| `ECA-14` | Art. 14 | Confirmation of orders |\n| `ECA-17` | Art. 17 | Right of withdrawal |\n| `ECA-21` | Art. 21 | Use of consumer information |\n| `ECA-24` | Art. 24 | Cybermall security |\n| `ECA-26` | Art. 26 | Protection of consumer information |\n\nFull Korean article text is included. Use `--live` to fetch the latest version from [law.go.kr](https://www.law.go.kr).\n\n## Privacy & Security\n\nklaws is designed to be safe to point at private code:\n\n- **Local-only analysis.** Scanning is pure static pattern-matching on files you pass in. Source code never leaves your machine — nothing is uploaded, logged remotely, or sent to any service.\n- **One optional outbound call.** The only network request klaws ever makes is the `--live` law lookup (CLI) / `get_law_reference` with live fetch (MCP), which fetches public statute text from [law.go.kr](https://www.law.go.kr). It sends only the statute's name (e.g. `개인정보보호법`, resolved from the provision you looked up) as the search query — never your code. Omit `--live` to stay fully offline.\n- **Read-only by design.** klaws only reads the files it scans; it never modifies your code. Its MCP tools are annotated read-only.\n- **Confine the reachable filesystem.** When exposing the MCP server, pass `--scan-root <dir>` to restrict `scan_directory`/`scan_file` to a single tree, and `--auth-token` when serving over `--http`. See [Securing a remote server](#securing-a-remote-server).\n\nTo report a vulnerability, see [SECURITY.md](SECURITY.md).\n\n## Architecture\n\n```\nklaws scan ./src\n       │\n       ▼\n   FileWalker ──► walks directory, matches glob pattern\n       │\n       ▼\n  ScannerService ──► reads each file\n       │\n       ▼\n  DetectorRegistry ──► runs all detectors on source code\n       │\n       ▼\n    Findings ──► mapped to law provisions\n       │\n       ▼\n   Report ──► JSON or text output\n```\n\n## Roadmap\n\n- **More detectors:** marketing-message consent (NIA-MKT-001) *(done)*, unprotected credit information (CIA-ENC-001) *(done)*, transaction-record retention (ECA-RET-001) *(done)*, personal-data retention (PIPA-RET-001) *(done)*, third-party/cross-border transfer (PIPA-XBR-001) *(done)*\n- **Multi-language:** Python, JavaScript/TypeScript detection patterns\n- **More Korean laws:** E-Commerce Act (전자상거래법) consumer protection rules *(done)*, Network Act (정보통신망법) *(done)*, Credit Information Act (신용정보법) *(done)*\n- **CI/CD:** GitHub Action, SARIF output, severity thresholds *(done)*\n- **Configuration:** custom pattern rules via config file\n\n## GitHub Action (CI)\n\nklaws ships a composite action that scans your code and produces a SARIF report, which you can upload to GitHub code scanning so findings appear inline on pull requests and in the **Security** tab.\n\n```yaml\n# .github/workflows/klaws.yml\nname: klaws compliance scan\non: [pull_request]\n\npermissions:\n  contents: read\n  security-events: write   # required to upload SARIF\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - id: klaws\n        uses: rostradamus/klaws@v0   # moving major tag; add `version: vX.Y.Z` below to pin the klaws binary\n        with:\n          path: ./src\n          pattern: \"*.java\"\n          fail-on: none      # or MEDIUM / HIGH to gate the PR\n\n      - name: Upload SARIF\n        if: always()          # upload even if fail-on tripped the step\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: ${{ steps.klaws.outputs.sarif }}\n```\n\nSet `fail-on: HIGH` (or `MEDIUM`) to make the check fail the PR when findings at that severity or above are present. The `if: always()` on the upload step ensures the SARIF is still published when the gate fails.\n\n## Releasing\n\nMaintainers: see [RELEASE.md](RELEASE.md) for how to cut a release and publish to the MCP registry.\n\n## License\n\nMIT\n",
  "bytes": 17176,
  "sha": "8daf599a8ade56f6605a854341c6d887377458856b161606da3bb786369fd6bf",
  "repo_slug": "rostradamus/klaws",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_rostradamus_klaws_16f96324/readme"
}