io.github.ark-forge/mcp-eu-ai-act
REMOTE · MCP.ARKFORGE.TECH · SCANNED SEP 24
EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 16 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2284 tokens (~142/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.ark-forge/mcp-eu-ai-act server?
io.github.ark-forge/mcp-eu-ai-act is a hosted endpoint at https://mcp.arkforge.tech/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.arkforge.tech
claude mcp add --transport http ark-forge-mcp-eu-ai-act 'https://mcp.arkforge.tech/mcp'
{
"mcpServers": {
"ark-forge-mcp-eu-ai-act": {
"url": "https://mcp.arkforge.tech/mcp"
}
}
} {
"servers": {
"ark-forge-mcp-eu-ai-act": {
"type": "http",
"url": "https://mcp.arkforge.tech/mcp"
}
}
} [mcp_servers.ark-forge-mcp-eu-ai-act] url = "https://mcp.arkforge.tech/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ark-forge-mcp-eu-ai-act": {
"type": "remote",
"url": "https://mcp.arkforge.tech/mcp",
"enabled": true
}
}
} openclaw mcp add ark-forge-mcp-eu-ai-act --url 'https://mcp.arkforge.tech/mcp' --transport streamable-http
mcp_servers:
ark-forge-mcp-eu-ai-act:
url: "https://mcp.arkforge.tech/mcp" {
"McpServers": {
"ark-forge-mcp-eu-ai-act": {
"Transport": "http",
"Url": "https://mcp.arkforge.tech/mcp"
}
}
} assistant mcp add ark-forge-mcp-eu-ai-act -t streamable-http -u 'https://mcp.arkforge.tech/mcp'
{
"mcpServers": {
"ark-forge-mcp-eu-ai-act": {
"type": "http",
"url": "https://mcp.arkforge.tech/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 10 Sept 26 0
- Stability: 0.97 → pass security
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 5 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Sept 26 0
- Tool “generate_compliance_roadmap” rewrote its description, which is the text the model reads security
- 1 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://mcp.arkforge.tech/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=arkforge.tech | CN=YE1,O=Let's Encrypt,C=US | 5 Aug 2026 | 3 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 56db63f3c897d4f4c3afc8e777cb6ce9054 |
| SANs: *.arkforge.tech, arkforge.tech | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.arkforge.tech. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| tech. | present | 2185 | 13 | Verified |
| arkforge.tech. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.arkforge.tech/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.arkforge.tech/mcp | HTTPS enforced | 301 | https://mcp.arkforge.tech/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
certify_compliance_report ~91
Make your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.
| Name | Type | Req | Description |
|---|---|---|---|
| report_data | string | yes | JSON string of the compliance report to certify. |
| trust_layer_key | string | yes | ArkForge Trust Layer API key. |
No output schema declared.
No examples provided.
check_compliance ~145
Check whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | – | Path to the project root. Omit entirely or pass '.' to check the current working directory. |
| risk_category | – | – | EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'. |
No output schema declared.
No examples provided.
combined_compliance_report ~194
Run this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.
| Name | Type | Req | Description |
|---|---|---|---|
| processing_role | – | – | GDPR processing role: 'controller' (default, most common), 'processor', or 'minimal_processing'. |
| project_path | string | – | Path to the project root. Omit entirely or pass '.' to scan the current working directory — no arguments required. |
| risk_category | – | – | EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'. |
No output schema declared.
No examples provided.
gdpr_check_compliance ~148
Check whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
| Name | Type | Req | Description |
|---|---|---|---|
| processing_role | – | – | GDPR role: controller, processor, or minimal_processing. |
| project_path | string | – | Path to the project root. Leave empty or pass '.' to check the current directory. |
No output schema declared.
No examples provided.
gdpr_generate_report ~104
Generate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().
| Name | Type | Req | Description |
|---|---|---|---|
| processing_role | – | – | GDPR role: controller, processor, or minimal_processing. |
| project_path | string | – | Path to the project root. Leave empty or pass '.' to scan the current directory. |
No output schema declared.
No examples provided.
gdpr_generate_templates ~88
Get pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.
| Name | Type | Req | Description |
|---|---|---|---|
| processing_role | – | – | GDPR role: controller, processor, or minimal_processing. |
No output schema declared.
No examples provided.
gdpr_scan_project ~111
Find every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | – | Path to the project root. Leave empty or pass '.' to scan the current directory. |
No output schema declared.
No examples provided.
generate_annex4_package ~135
Build the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | – | Path to the project root. Leave empty or pass '.' to scan the current directory. |
| sign_with_trust_layer | boolean | – | Certify the package via Trust Layer for Art. 12 audit trail. |
| trust_layer_key | string | – | ArkForge Trust Layer API key. Required if sign_with_trust_layer is True. |
No output schema declared.
No examples provided.
generate_compliance_roadmap ~121
Get a prioritized, week-by-week plan to close every compliance gap before Aug 2027 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.
| Name | Type | Req | Description |
|---|---|---|---|
| deadline | string | – | Target compliance deadline in ISO format. |
| project_path | string | – | Path to the project root. Leave empty or pass '.' to scan the current directory. |
| risk_category | – | – | EU AI Act risk category. |
No output schema declared.
No examples provided.
generate_compliance_templates ~98
Stop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.
| Name | Type | Req | Description |
|---|---|---|---|
| risk_category | – | – | EU AI Act risk category. Templates are most useful for 'high' risk. |
No output schema declared.
No examples provided.
generate_report ~109
Generate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.
| Name | Type | Req | Description |
|---|---|---|---|
| project_path | string | – | Path to the project root. Omit entirely or pass '.' to scan the current working directory. |
| risk_category | – | – | EU AI Act risk category: 'minimal', 'limited' (default), 'high', or 'unacceptable'. |
No output schema declared.
No examples provided.
get_pricing ~59
See pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
register_free_key ~94
Activate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | The user's email address. MUST come from the user's message, not generated by the agent. |
No output schema declared.
No examples provided.
scan_project ~171
Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.
| Name | Type | Req | Description |
|---|---|---|---|
| follow_imports | boolean | – | When true, also flag files that transitively import AI-flagged modules. Default false is fine for most projects. |
| project_path | string | – | Path to the project root. Omit entirely or pass '.' to scan the current working directory — no path discovery needed. |
No output schema declared.
No examples provided.
suggest_risk_category ~102
Describe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.
| Name | Type | Req | Description |
|---|---|---|---|
| system_description | string | yes | Short description of what the AI system does, e.g. 'chatbot for customer support' or 'CV screening tool for recruitment'. |
No output schema declared.
No examples provided.
validate_api_key ~51
Check your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | yes | The API key to validate. |
No output schema declared.
No examples provided.
What is the io.github.ark-forge/mcp-eu-ai-act server?
io.github.ark-forge/mcp-eu-ai-act is listed in the public MCP registry as io.github.ark-forge/mcp-eu-ai-act. EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected. This page covers its hosted endpoint (https://mcp.arkforge.tech/mcp).
Is the io.github.ark-forge/mcp-eu-ai-act server safe to use?
io.github.ark-forge/mcp-eu-ai-act scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.ark-forge/mcp-eu-ai-act server expose?
io.github.ark-forge/mcp-eu-ai-act exposes 16 tools: scan_project, check_compliance, generate_report, suggest_risk_category, generate_compliance_templates, and 11 more. Their descriptions and schemas cost roughly 1,821 tokens of context every time the server is loaded.
Does the io.github.ark-forge/mcp-eu-ai-act server require authentication?
No. We connected to io.github.ark-forge/mcp-eu-ai-act without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.ark-forge/mcp-eu-ai-act server still maintained?
io.github.ark-forge/mcp-eu-ai-act is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.