# com.bidda/bidda-compliance (remote · bidda.com)

10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).

- Trust score: 58/100 (low)
- Change this week: +1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `bidda.com`: 58/100 (this document), [markdown](https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda.md), [page](https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda)

## Channel facts

- Endpoint: `https://bidda.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.6.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 25 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS check failed: the endpoint is reachable over plaintext HTTP.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 68/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3735 tokens (~149/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-bidda-bidda-compliance https://bidda.com/mcp
```

### Codex

```toml
[mcp_servers.com-bidda-bidda-compliance]
url = "https://bidda.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-bidda-bidda-compliance": {
      "type": "remote",
      "url": "https://bidda.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-bidda-bidda-compliance --url https://bidda.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-bidda-bidda-compliance:
    url: "https://bidda.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-bidda-bidda-compliance": {
      "type": "http",
      "url": "https://bidda.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 57, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-29 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 57, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 56)

First indexed and scored.

## MCP tools (25)

### `list_pillars` (~101 tokens)

List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 10,085 cryptographically-verified nodes across 39 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.

### `search_nodes` (~171 tokens)

Search Bidda compliance nodes by keyword. Returns matching node summaries including a one-sentence BLUF (Bottom Line Up Front): the exact compliance obligation in plain language. Every node traces to a primary legal source (no hallucination). Examples: "Basel III capital", "GDPR data breach", "AML transaction monitoring", "SOC 2 Type II".

Input parameters:

- `limit` (number): Max results (default 10, max 25)
- `pillar` (string): Optional: filter by pillar name, e.g. "Banking & Global Finance", "Cybersecurity", "AI Governance & Law", "Medical & Healthcare"
- `query` (string, required): Search terms, e.g. "Basel III capital requirements", "GDPR data breach notification 72 hours", "FATF travel rule"

### `get_node` (~118 tokens)

Get a specific compliance node by its ID. Returns the node summary: title, compliance pillar, version, last updated, and BLUF. The full node (machine-executable deterministic workflow, actionable schema, primary legal citations, dependency chain) is available at bidda.com.

Input parameters:

- `id` (string, required): Node ID, e.g. "basel-iii-capital", "gdpr-article-5-principles", "fatf-40-recommendations-2023-consolidated", "us-hipaa-privacy-rule"

### `get_dependency_chain` (~107 tokens)

Walk the prerequisite chain for a compliance node. Given one node, returns its full dependency tree (the prior obligations an agent must satisfy before this one applies). Use this to plan a complete compliance posture: unlocking one node usually requires understanding 3-8 upstream nodes. Defaults to depth 2; max 4.

Input parameters:

- `max_depth` (integer): How many hops to walk (1-4). Default 2.
- `node_id` (string, required): Root node ID to expand from.

### `get_crosswalk` (~82 tokens)

Return the cross-framework mapping dimensions for a node: which other regulations, standards, or jurisdictions this rule maps to (e.g. GDPR Article 17 → CCPA right-to-delete → POPIA Section 24). Discovery returns the available dimensions; full mapping values are vault-gated.

Input parameters:

- `node_id` (string, required): Node ID to inspect crosswalks for.

### `get_latest_changes` (~99 tokens)

List the most recently updated compliance nodes: the regulatory change feed. Use to monitor incoming amendments, new guidance, or freshly added rules. Filter by pillar to focus on a domain. Agents should call this on a schedule to keep compliance posture current.

Input parameters:

- `days` (integer): Look back N days. Default 30. Max 180.
- `pillar` (string): Optional pillar filter, e.g. "AI Governance" or "Cybersecurity".

### `get_jurisdiction_bundle` (~120 tokens)

Return all compliance nodes that apply in a specific jurisdiction (EU, US, UK, Australia, Singapore, India, Canada, China, South Africa, Japan, Brazil and others). Use when an agent enters a new market and needs the full regulatory surface for that geography.

Input parameters:

- `jurisdiction` (string, required): Jurisdiction code or name: eu, us, uk, au, sg, india, canada, china, south-africa, japan, brazil.
- `limit` (integer): Max nodes to return. Default 25. Max 100.

### `get_mitre_mapping` (~294 tokens)

The MITRE Rosetta Stone. Given a MITRE technique ID across 5 frameworks (ATT&CK Enterprise, ATT&CK Mobile, ATT&CK ICS, D3FEND, ATLAS), return the Bidda node for that technique plus its mapped compliance obligations: NIST 800-53 controls, ISO 27001 Annex A clauses, PCI DSS requirements, NIS2 articles, HIPAA Security Rule, DORA articles, NERC CIP, IEC 62443. The bridge between how SOC teams think (technique IDs) and how compliance teams think (control families). Free.

Input parameters:

- `technique_id` (string, required): MITRE technique ID. ATT&CK Enterprise (T1566, T1486, T1078, T1003.001, T1547.001); ATT&CK Mobile (T1474, T1521, T1471, T1430, T1417); ATT&CK ICS (T0883, T0809, T0879, T0886, T0814); D3FEND (D3-FIM, D…

### `check_action_compliance` (~135 tokens)

Pre-flight regulatory check. Agent describes an intended action in natural language ("process EU resident biometric data", "transfer health records to a third-party AI vendor", "deploy autonomous trading model in Singapore") and receives a ranked list of regulations that may apply, plus a risk indicator (LOW/MODERATE/HIGH). The primary tool for runtime compliance gating in autonomous agent workflows.

Input parameters:

- `action` (string, required): Natural-language description of the intended action.
- `jurisdiction` (string): Optional jurisdiction filter (eu, us, uk, etc.).
- `limit` (integer): Max matches to return. Default 10. Max 25.

### `browse_topics` (~93 tokens)

Browse the registry by cross-cutting compliance TOPIC (for example data breach notification, AI transparency, AML and KYC). Returns each topic with how many rules carry it and across how many pillars and jurisdictions. Topics sit on top of the 39 pillars without replacing them. Free, no key required. Pass a topic string to drill into one.

Input parameters:

- `topic` (string): Optional topic name to filter or drill into.

### `compare_jurisdictions` (~122 tokens)

Compare how different jurisdictions address a compliance topic, side by side, including where their numeric thresholds differ (for example a breach-notification deadline of 72 hours versus 30 days). It surfaces the real rules and numbers and does not rank which jurisdiction is stricter. Requires an active Bidda subscription: pass your key as api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key (sent as x-bidda-api-key). A free trial counts.
- `topic` (string, required): Topic to compare, for example "data breach notification".

### `create_attestation` (~159 tokens)

Create a signed, time-stamped record of which Bidda rules a person or AI agent relied on for a decision. Returns a record ID and a public verify URL so anyone can later confirm the record has not been changed. Useful for agents that must keep an audit trail of what they checked. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `action` (string): Optional: what the agent did.
- `agent` (string, required): The system or AI agent that made the decision.
- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `nodes` (array, required): node_ids that were checked (max 50).
- `workflow_steps_followed` (array): Optional: steps the agent followed.

### `point_in_time` (~114 tokens)

Get a signed record of which committed version of a rule was authoritative at a specific past date, anchored to the public history chain. Useful when an agent must show what a rule said at the moment it acted. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `as_of` (string): ISO date or time, or epoch milliseconds. Defaults to now.
- `node_id` (string, required): The rule (node_id).

### `watch_changes` (~141 tokens)

Subscribe to regulatory change alerts: watch specific rules and/or whole pillars and get notified by email or webhook when their primary source changes. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `channels` (object): Delivery channels, for example { "email": true, "webhook": false }. Defaults to email.
- `label` (string): Optional name for the alert.
- `nodes` (array): node_ids to watch.
- `pillars` (array): Pillar names to watch.
- `webhook_url` (string): Required if the webhook channel is enabled.

### `open_run` (~132 tokens)

Open a run ledger: a signed, tamper-evident log of what an agent does across a whole task or conversation (for example a support-bot chat). Returns a run_id. Record one entry per turn with record_run_entry, then seal_run to get a single signed Run Receipt. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `agent` (string, required): The system or agent running the task or conversation.
- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `label` (string): Optional human label, for example the chat or ticket id.

### `record_run_entry` (~339 tokens)

Append one entry to an open run: which Bidda rules the agent consulted, what it decided, and the end user's input (as text via note, or privately as input_hash). Each entry is hash-chained to the previous one. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `action` (string): Optional: an action the agent took or checked.
- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `decision` (string): Optional: what the agent decided or did this turn.
- `entry_type` (string): Optional: node_consulted | action_checked | decision | note. Defaults to note.
- `input_hash` (string): Optional: a sha256:... hash of the user's message instead of the text.
- `model` (string): Optional: the model id/version that produced this decision (e.g. gpt-4o-2024-08-06).
- `nodes` (array): Optional node_ids the agent consulted (max 50).
- `note` (string): Optional: the end user's message as text.
- `output_hash` (string): Optional: a sha256:... hash of the agent's output.
- `run_id` (string, required): The run_id returned by open_run.
- `subject_hash` (string): Optional: a sha256:... hash of an end-user identifier for per-subject traceability. Hash only, never plaintext.
- `verify_nodes` (boolean): Optional: pin each node in "nodes" to its current version + integrity hash (proof, not just a claim). No extra call charge.

### `consult_node` (~266 tokens)

The one-call governed turn: fetch the full vault node (this consumes one call on your key, exactly like unlocking a node) AND record a verified node_consulted entry for it on an open run, in a single step. The entry pins the node to its current version + integrity hash, so the run receipt proves what the agent actually consulted. Use this instead of get_node when you are inside a run. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `action` (string): Optional: an action the agent took or checked.
- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `decision` (string): Optional: what the agent decided using this node.
- `input_hash` (string): Optional: a sha256:... hash of the user's message instead of the text.
- `model` (string): Optional: the model id/version making the decision.
- `node_id` (string, required): The rule to fetch and record.
- `run_id` (string, required): The open run to record into (from open_run).
- `subject_hash` (string): Optional: a sha256:... hash of an end-user identifier. Hash only.
- `user_input` (string): Optional: the end user's message as text.

### `get_audit_pack` (~147 tokens)

Export a run as a governance evidence pack: the signed receipt, every entry, a roll-up of the nodes consulted (with pinned versions/hashes), an independent hash-chain + Merkle integrity self-check, and a coversheet mapping the receipt to the record-keeping obligations it supports (EU AI Act Art. 12/26, ISO/IEC 42001, NIST AI RMF). A sealed run is readable by id; a still-open run's draft pack needs your api_key.

Input parameters:

- `api_key` (string): Optional: your Bidda key, required for a still-open (unsealed) run.
- `run_id` (string, required): The run to export.

### `seal_run` (~85 tokens)

Seal an open run into one signed Run Receipt covering every entry, with a public verify URL. Idempotent: sealing an already-sealed run returns the same receipt. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `run_id` (string, required): The run_id to seal.

### `get_run` (~82 tokens)

Fetch a run and its entries. The owner can read an open or sealed run (pass api_key); a sealed run is also publicly readable by id and reports whether its signature is valid.

Input parameters:

- `api_key` (string): Optional: your Bidda key, required to read your own still-open run.
- `run_id` (string, required): The run_id to fetch.

### `drift_check` (~133 tokens)

Check whether the compliance rules an agent has cached in its own memory are still current. Submit the node_id and the integrity hash you stored when you last grounded on each rule; get back, per rule, whether it is fresh, has drifted (content changed), or was withdrawn (instrument repealed) - so the agent re-grounds before acting on stale law. Included with every API tier; the per-call batch size scales with your plan. Pass api_key.

Input parameters:

- `anchors` (array, required): The cached rules to check.
- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.

### `create_control_attestation` (~267 tokens)

Sign a tamper-evident record of one of YOUR OWN controls or policies and the Bidda obligation nodes it maps to. Each obligation is pinned to its current version + integrity hash at signing time, so the record shows what the control was mapped against on that date. This is the design-side evidence ('we operate this control, mapped to these obligations'); run receipts are the operating-side evidence. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `control` (string, required): The name of your control or policy.
- `control_owner` (string): Optional: the role or team that owns the control.
- `control_status` (string): Optional: implemented | planned | in-progress.
- `effective_date` (string): Optional: YYYY-MM-DD the control took effect.
- `evidence_ref` (string): Optional: a reference/URL/hash to your own evidence (kept by you).
- `framework` (string): Optional: the framework you are mapping to (e.g. "EU AI Act").
- `nodes` (array, required): Obligation node_ids the control maps to (max 50).
- `statement` (string, required): What the control does or asserts (plain text).

### `gap_check` (~139 tokens)

Given the compliance rules a team says it covers, return the prerequisite rules Bidda's dependency graph links to them that were NOT listed - the 'you missed the prerequisite obligation' gaps - plus any covered rule the registry marks withdrawn. A coverage aid for a qualified reviewer; it does not rank or determine compliance. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `depth` (number): Optional: how many dependency hops to walk (1-3, default 1).
- `nodes` (array, required): The node_ids you cover (max 200).

### `obligation_deltas` (~164 tokens)

The obligation-level change feed: primary sources whose content changed (or whose node was withdrawn), mapped to the Bidda obligation nodes they affect, filterable by time, pillar, or specific nodes. Use it to answer 'what obligations changed since I last reviewed?'. Requires an active Bidda subscription: pass api_key.

Input parameters:

- `api_key` (string, required): Your Bidda subscription API key. A free trial counts.
- `limit` (number): Optional: max deltas to return (default 100, max 500).
- `nodes` (array): Optional: restrict to deltas affecting these node_ids.
- `pillar` (string): Optional: restrict to one pillar.
- `since` (string): Optional: ISO timestamp; only deltas newer than this are returned.

### `oscal_assessment_results` (~125 tokens)

Export a governed run's evidence as a NIST OSCAL assessment-results document (the machine-readable format GRC and audit tooling consumes): reviewed-controls (the obligation nodes consulted), observations (each pinned to its version + integrity hash), and props recording the independent integrity self-check. A sealed run is readable by id; a still-open run needs your api_key.

Input parameters:

- `api_key` (string): Optional: your Bidda key, required for a still-open (unsealed) run.
- `run_id` (string, required): The run to export as OSCAL assessment-results.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda#diagnostics

## Score history

- 2026-08-03: 58
- 2026-08-02: 57
- 2026-08-01: 57
- 2026-07-31: 57
- 2026-07-30: 59
- 2026-07-29: 58
- 2026-07-28: 57
- 2026-07-27: 57
- 2026-07-26: 56

## Links

- Remote endpoint: https://bidda.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-bidda-bidda-compliance/bidda