# io.github.ark-forge/mcp-eu-ai-act (remote · mcp.arkforge.tech)

EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.

- Trust score: 23/100 (low)
- Change this week: −31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.arkforge.tech`: 23/100 (this document), [markdown](https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp.md), [page](https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp)

## Channel facts

- Endpoint: `https://mcp.arkforge.tech/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `2.0.31`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint returned HTTP 521.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 4 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add --transport http ark-forge-mcp-eu-ai-act https://mcp.arkforge.tech/mcp
```

### Codex

```toml
[mcp_servers.ark-forge-mcp-eu-ai-act]
url = "https://mcp.arkforge.tech/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ark-forge-mcp-eu-ai-act": {
      "type": "remote",
      "url": "https://mcp.arkforge.tech/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ark-forge-mcp-eu-ai-act --url https://mcp.arkforge.tech/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ark-forge-mcp-eu-ai-act:
    url: "https://mcp.arkforge.tech/mcp"
```

### Other

```json
{
  "mcpServers": {
    "ark-forge-mcp-eu-ai-act": {
      "type": "http",
      "url": "https://mcp.arkforge.tech/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-07-31 (score 23, +9)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 14, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 14, −40)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.03 → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 54, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 53)

First indexed and scored.

## MCP tools (16)

### `scan_project` (~171 tokens)

Find out in 5 seconds if your project triggers EU AI Act obligations — no arguments, no setup. Scans for 22 AI/ML frameworks (OpenAI, Anthropic, LangChain, HuggingFace, PyTorch, TensorFlow, scikit-learn…), returns your risk category and the legal actions required before you ship. Enforcement live since Feb 2025 — fines up to 35M EUR. For EU AI Act + GDPR together, call combined_compliance_report() instead.

Input parameters:

- `follow_imports` (boolean): When true, also flag files that transitively import AI-flagged modules. Default false is fine for most projects.
- `project_path` (string): Path to the project root. Omit entirely or pass '.' to scan the current working directory — no path discovery needed.

### `check_compliance` (~145 tokens)

Check whether your project passes or fails each EU AI Act requirement — no arguments, 5 seconds. See exactly which articles you violate (Art. 52 transparency, Art. 11 documentation, Art. 14 human oversight, Art. 15 robustness) and get step-by-step fix instructions for every gap. Call combined_compliance_report() for EU AI Act + GDPR together.

Input parameters:

- `project_path` (string): Path to the project root. Omit entirely or pass '.' to check the current working directory.
- `risk_category`: EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.

### `generate_report` (~109 tokens)

Generate the compliance report your legal team is asking for — no arguments. One call auto-detects AI frameworks, runs gap analysis, and produces a structured remediation plan ready for legal review or DPIA attachment. No API key needed.

Input parameters:

- `project_path` (string): Path to the project root. Omit entirely or pass '.' to scan the current working directory.
- `risk_category`: EU AI Act risk category: 'minimal', 'limited' (default), 'high', or 'unacceptable'.

### `suggest_risk_category` (~102 tokens)

Describe what your AI system does in plain language — get back your EU AI Act risk tier, the articles that apply, and your first compliance step. Returns matched category (minimal/limited/high/unacceptable) with confidence level and triggering risk indicators. No project scan needed, no API key.

Input parameters:

- `system_description` (string, required): Short description of what the AI system does, e.g. 'chatbot for customer support' or 'CV screening tool for recruitment'.

### `generate_compliance_templates` (~98 tokens)

Stop writing compliance docs from scratch — get pre-filled templates for risk management, technical documentation, transparency notice, and human oversight policy tailored to your risk category. High-risk systems get all 6 mandatory documents. Save to docs/, fill in [bracketed] sections. Run check_compliance() first to see which documents you're missing.

Input parameters:

- `risk_category`: EU AI Act risk category. Templates are most useful for 'high' risk.

### `generate_compliance_roadmap` (~121 tokens)

Get a prioritized, week-by-week plan to close every compliance gap before Aug 2026 — no arguments. Auto-scans your project, ranks fixes by impact, sequences quick wins first, tells you whether your deadline is achievable. Pro plan required — run check_compliance() for a free gap summary.

Input parameters:

- `deadline` (string): Target compliance deadline in ISO format.
- `project_path` (string): Path to the project root. Leave empty or pass '.' to scan the current directory.
- `risk_category`: EU AI Act risk category.

### `generate_annex4_package` (~135 tokens)

Build the Annex IV evidence package your auditor needs for high-risk AI — no arguments. All 8 mandatory sections auto-populated from your project scan, SHA-256 integrity hash included. High-risk rules apply Aug 2026. Pro plan required.

Input parameters:

- `project_path` (string): Path to the project root. Leave empty or pass '.' to scan the current directory.
- `sign_with_trust_layer` (boolean): Certify the package via Trust Layer for Art. 12 audit trail.
- `trust_layer_key` (string): ArkForge Trust Layer API key. Required if sign_with_trust_layer is True.

### `certify_compliance_report` (~91 tokens)

Make your compliance report tamper-proof for Art. 12 audit trail — pass the report JSON, get back a proof_id and a public verification URL you can hand to auditors. Certified plan required. Run generate_report() first to produce the report.

Input parameters:

- `report_data` (string, required): JSON string of the compliance report to certify.
- `trust_layer_key` (string, required): ArkForge Trust Layer API key.

### `validate_api_key` (~51 tokens)

Check your API key status — returns plan tier (free/pro/certified), email, and usage stats (total scans, last scan date).

Input parameters:

- `api_key` (string, required): The API key to validate.

### `register_free_key` (~94 tokens)

Activate a free API key — unlocks scan history and CI/CD integration. Pass the user's email, no password or credit card. IMPORTANT: ask the user to type their email first, wait for their reply, then call this with the exact email they typed. Do NOT pass a placeholder or fabricated email.

Input parameters:

- `email` (string, required): The user's email address. MUST come from the user's message, not generated by the agent.

### `gdpr_scan_project` (~111 tokens)

Find every file in your project that touches personal data — no arguments, 5 seconds, free. Detects PII fields, cookies, tracking pixels, analytics SDKs, and consent flows. Returns flagged files with data categories and applicable GDPR articles. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Input parameters:

- `project_path` (string): Path to the project root. Leave empty or pass '.' to scan the current directory.

### `gdpr_check_compliance` (~148 tokens)

Check whether your project passes or fails each GDPR requirement — no arguments. See pass/fail for lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 15–22), security (Art. 32), and breach notification (Art. 33–34) with fix instructions for every gap. GDPR fines reach 20M EUR or 4% turnover. For EU AI Act + GDPR together, call combined_compliance_report().

Input parameters:

- `processing_role`: GDPR role: controller, processor, or minimal_processing.
- `project_path` (string): Path to the project root. Leave empty or pass '.' to check the current directory.

### `gdpr_generate_report` (~104 tokens)

Generate the GDPR report your DPO needs — no arguments. Combines personal data inventory, gap analysis, and remediation steps in one structured document for DPO review, audit prep, or regulatory response. For EU AI Act + GDPR together, call combined_compliance_report().

Input parameters:

- `processing_role`: GDPR role: controller, processor, or minimal_processing.
- `project_path` (string): Path to the project root. Leave empty or pass '.' to scan the current directory.

### `gdpr_generate_templates` (~88 tokens)

Get pre-filled GDPR templates your organization actually needs — no arguments. Privacy Policy, DPIA, Records of Processing Activities (ROPA), and Data Breach Procedure tailored to your processing role. Fill in [bracketed] sections. Run gdpr_check_compliance() first to see which documents you're missing.

Input parameters:

- `processing_role`: GDPR role: controller, processor, or minimal_processing.

### `combined_compliance_report` (~194 tokens)

Run this before your next deploy. One call reveals every EU AI Act + GDPR gap in your codebase — no arguments, no setup, under 10 seconds, free. Detects AI frameworks and personal data flows, flags where both laws overlap, returns pass/fail per article with a prioritized fix list. EU AI Act fines up to 35M EUR, GDPR up to 20M EUR. Replaces separate scan_project() and gdpr_scan_project() calls.

Input parameters:

- `processing_role`: GDPR processing role: 'controller' (default, most common), 'processor', or 'minimal_processing'.
- `project_path` (string): Path to the project root. Omit entirely or pass '.' to scan the current working directory — no arguments required.
- `risk_category`: EU AI Act risk category: 'minimal', 'limited' (default, fits most AI apps), 'high', or 'unacceptable'.

### `get_pricing` (~59 tokens)

See pricing and features for every plan — Free (10 scans/day, full reports), Pro (29 EUR/mo, unlimited + CI/CD), Certified (cryptographic audit trail). No arguments. Call register_free_key() to activate your free API key.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp#diagnostics

## Score history

- 2026-08-03: 23
- 2026-08-02: 23
- 2026-08-01: 23
- 2026-07-31: 23
- 2026-07-30: 14
- 2026-07-29: 14
- 2026-07-28: 14
- 2026-07-27: 54
- 2026-07-26: 53

## Links

- Remote endpoint: https://mcp.arkforge.tech/mcp
- Repository: https://github.com/ark-forge/mcp-eu-ai-act
- Changelog RSS feed: https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ark-forge-mcp-eu-ai-act/mcp