io.github.ark-forge/mcp-eu-ai-act

REMOTE · MCP.ARKFORGE.TECH · SCANNED AUG 3

EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.

Available components

−31 this week 23 23 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →

Endpoint Security57

The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. View diagnostics → Unverified
HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail

Transport & Reachability0

Transport check failed: declared streamable-http, but the endpoint returned HTTP 521. See how to fix → View diagnostics → Fail

Schema Quality & AI Usability0

Schema not yet verified: we couldn't read the endpoint's schema.Unverified

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage0

Tool coverage not yet verified: we couldn't read the endpoint's tools.Unverified

Capabilities0

Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified

Unverified: 4 categories

Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

remote · mcp.arkforge.tech

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add --transport http ark-forge-mcp-eu-ai-act https://mcp.arkforge.tech/mcp

# ~/.codex/config.toml

[mcp_servers.ark-forge-mcp-eu-ai-act]
url = "https://mcp.arkforge.tech/mcp"

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ark-forge-mcp-eu-ai-act": {
      "type": "remote",
      "url": "https://mcp.arkforge.tech/mcp",
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add ark-forge-mcp-eu-ai-act --url https://mcp.arkforge.tech/mcp --transport streamable-http

# ~/.hermes/config.yaml

mcp_servers:
  ark-forge-mcp-eu-ai-act:
    url: "https://mcp.arkforge.tech/mcp"

// mcp.json

{
  "mcpServers": {
    "ark-forge-mcp-eu-ai-act": {
      "type": "http",
      "url": "https://mcp.arkforge.tech/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

31 Jul 26 +9
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
28 Jul 26 −40
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: 0.03 → unverified ▼ security
- Transport: pass → fail ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
26 Jul 26 53

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Probed https://mcp.arkforge.tech/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject	Issuer	Valid from	Valid until	Key	Signature	Serial
CN=arkforge.tech	CN=YE1,O=Let's Encrypt,C=US	7 Jun 2026	5 Sept 2026	ECDSA 256	ECDSA-SHA384	6f66b8c856a74f6d69689b90c172f344ea2
SANs: *.arkforge.tech, arkforge.tech
CN=YE1,O=Let's Encrypt,C=US (CA)	CN=Root YE,O=ISRG,C=US	3 Sept 2025	2 Sept 2028	ECDSA 384	ECDSA-SHA384	5ddd70dd31f801c85c186a7a04b80afe
CN=Root YE,O=ISRG,C=US (CA)	CN=ISRG Root X2,O=Internet Security Research Group,C=US	13 May 2026	2 Sept 2032	ECDSA 384	ECDSA-SHA384	872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA)	CN=ISRG Root X1,O=Internet Security Research Group,C=US	13 May 2026	2 Sept 2032	ECDSA 384	SHA256-RSA	6c8f1dc727c7117f7baf853ac980f9cd

DNSSEC insecure

Validation of mcp.arkforge.tech. — Not signed

Zone	DS	Keys	Algorithms	Outcome
.	trust_anchor	20326, 38696	8, 8	Verified
tech.	present	2185	13	Verified
arkforge.tech.	absent			Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation

Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result	No authorisation required
HTTP status	521

Header	Value
x-frame-options	SAMEORIGIN
referrer-policy	same-origin

Transports 2 probes

Transport	URL	Outcome	Status	Location
streamable-http	https://mcp.arkforge.tech/mcp	HTTP error	521
http (plaintext)	http://mcp.arkforge.tech/mcp	HTTPS enforced	301	https://mcp.arkforge.tech/mcp

MCP tools — 16 exposed · ~1,821 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

certify_compliance_report ~91

Make your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.

Input Output Examples

Name	Type	Req	Description
report_data	string	yes	JSON string of the compliance report to certify.
trust_layer_key	string	yes	ArkForge Trust Layer API key.

No output schema declared.

No examples provided.

check_compliance ~145

Check whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.

Input Output Examples

Name	Type	Req	Description
project_path	string	—	Path to the project root. Omit entirely or pass '.' to check the current working directory.
risk_category	—	—	EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.

No output schema declared.

No examples provided.

combined_compliance_report ~194

Run this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.

Input Output Examples

Name	Type	Req	Description
processing_role	—	—	GDPR processing role: 'controller' (default, most common), 'processor', or 'minimal_processing'.
project_path	string	—	Path to the project root. Omit entirely or pass '.' to scan the current working directory — no arguments required.
risk_category	—	—	EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.

No output schema declared.

No examples provided.

gdpr_check_compliance ~148

Check whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Input Output Examples

Name	Type	Req	Description
processing_role	—	—	GDPR role: controller, processor, or minimal_processing.
project_path	string	—	Path to the project root. Leave empty or pass '.' to check the current directory.

No output schema declared.

No examples provided.

gdpr_generate_report ~104

Generate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().

Input Output Examples

Name	Type	Req	Description
processing_role	—	—	GDPR role: controller, processor, or minimal_processing.
project_path	string	—	Path to the project root. Leave empty or pass '.' to scan the current directory.

No output schema declared.

No examples provided.

gdpr_generate_templates ~88

Get pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.

Input Output Examples

Name	Type	Req	Description
processing_role	—	—	GDPR role: controller, processor, or minimal_processing.

No output schema declared.

No examples provided.

gdpr_scan_project ~111

Find every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Input Output Examples

Name	Type	Req	Description
project_path	string	—	Path to the project root. Leave empty or pass '.' to scan the current directory.

No output schema declared.

No examples provided.

generate_annex4_package ~135

Build the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.

Input Output Examples

Name	Type	Req	Description
project_path	string	—	Path to the project root. Leave empty or pass '.' to scan the current directory.
sign_with_trust_layer	boolean	—	Certify the package via Trust Layer for Art. 12 audit trail.
trust_layer_key	string	—	ArkForge Trust Layer API key. Required if sign_with_trust_layer is True.

No output schema declared.

No examples provided.

generate_compliance_roadmap ~121

Get a prioritized, week-by-week plan to close every compliance gap before Aug 2026 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.

Input Output Examples

Name	Type	Req	Description
deadline	string	—	Target compliance deadline in ISO format.
project_path	string	—	Path to the project root. Leave empty or pass '.' to scan the current directory.
risk_category	—	—	EU AI Act risk category.

No output schema declared.

No examples provided.

generate_compliance_templates ~98

Stop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.

Input Output Examples

Name	Type	Req	Description
risk_category	—	—	EU AI Act risk category. Templates are most useful for 'high' risk.

No output schema declared.

No examples provided.

generate_report ~109

Generate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.

Input Output Examples

Name	Type	Req	Description
project_path	string	—	Path to the project root. Omit entirely or pass '.' to scan the current working directory.
risk_category	—	—	EU AI Act risk category: 'minimal', 'limited' (default), 'high', or 'unacceptable'.

No output schema declared.

No examples provided.

get_pricing ~59

See pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

register_free_key ~94

Activate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.

Input Output Examples

Name	Type	Req	Description
email	string	yes	The user's email address. MUST come from the user's message, not generated by the agent.

No output schema declared.

No examples provided.

scan_project ~171

Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.

Input Output Examples

Name	Type	Req	Description
follow_imports	boolean	—	When true, also flag files that transitively import AI-flagged modules. Default false is fine for most projects.
project_path	string	—	Path to the project root. Omit entirely or pass '.' to scan the current working directory — no path discovery needed.

No output schema declared.

No examples provided.

suggest_risk_category ~102

Describe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.

Input Output Examples

Name	Type	Req	Description
system_description	string	yes	Short description of what the AI system does, e.g. 'chatbot for customer support' or 'CV screening tool for recruitment'.

No output schema declared.

No examples provided.

validate_api_key ~51

Check your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).

Input Output Examples

Name	Type	Req	Description
api_key	string	yes	The API key to validate.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	53
27 Jul	54
28 Jul	14
29 Jul	14
30 Jul	14
31 Jul	23
1 Aug	23
2 Aug	23
3 Aug	23