# Hermetics RGPD (remote · hermetics.fr)

EU data protection law for AI agents: GDPR, AI Act, EDPB, CJEU and national law, with status.

- Trust score: 38/100 (low)
- Change this week: −46
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `hermetics.fr`: 38/100 (this document), [markdown](https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp.md), [page](https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp)

## Channel facts

- Endpoint: `https://hermetics.fr/api/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `0.5.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 94/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http.
- **Schema Quality & AI Usability**: 0/100
  - Schema blocked by authentication: the endpoint requires auth we don't have to read it.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.
- **Tool Safety**: 0/100
  - Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.
- **Capabilities**: 0/100
  - Capabilities blocked by authentication: the endpoint requires auth we don't have to read them.

**Unverified: 6 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Hermetics RGPD MCP server?

Hermetics RGPD is a hosted endpoint at https://hermetics.fr/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http fr-hermetics-rgpd 'https://hermetics.fr/api/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "fr-hermetics-rgpd": {
      "url": "https://hermetics.fr/api/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "fr-hermetics-rgpd": {
      "type": "http",
      "url": "https://hermetics.fr/api/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.fr-hermetics-rgpd]
url = "https://hermetics.fr/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "fr-hermetics-rgpd": {
      "type": "remote",
      "url": "https://hermetics.fr/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add fr-hermetics-rgpd --url 'https://hermetics.fr/api/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  fr-hermetics-rgpd:
    url: "https://hermetics.fr/api/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "fr-hermetics-rgpd": {
      "Transport": "http",
      "Url": "https://hermetics.fr/api/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add fr-hermetics-rgpd -t streamable-http -u 'https://hermetics.fr/api/mcp'
```

### Other

```json
{
  "mcpServers": {
    "fr-hermetics-rgpd": {
      "type": "http",
      "url": "https://hermetics.fr/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-01 (score 38, −47)

- [security regression] Endpoint reachability: reachable → behind authorisation
- [security regression] Stability: 0.63 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Transport: pass → unverified
- [security] Authorization: The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-10-31 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 83, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “record_request” rewrote its description, which is the text the model reads
- [security] Tool “report_breach” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 2810 → 3441
- [functional] Server version: 0.4.0 → 0.5.0
- [functional] New tool “hermetics_message”
- [functional] New tool “hermetics_status”
- [cosmetic] “save_processing_record” added an optional parameter “department”
- [cosmetic] “save_processing_record” added an optional parameter “internal_recipients”
- [cosmetic] “save_processing_record” added an optional parameter “transfers_outside_eea_status”
- [cosmetic] “save_processing_record” reworded the description of “transfers_outside_eea”

### 2026-10-24 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 81, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “save_processing_record” rewrote its description, which is the text the model reads

### 2026-10-20 (score 80, +1)

- [security] Tool “list_processing_records” rewrote its description, which is the text the model reads

### 2026-10-17 (score 79, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “prepare_analysis” rewrote its description, which is the text the model reads
- [security] Tool “record_request” rewrote its description, which is the text the model reads
- [security] Tool “report_breach” rewrote its description, which is the text the model reads
- [security] Tool “save_processing_record” rewrote its description, which is the text the model reads

## MCP tools (10)

### `search_law` (~154 tokens)

Search EU data protection law

Searches the official texts on data protection (GDPR, ePrivacy, AI Act, EDPB guidance, CJEU case law, and the national law, authority guidance and decisions held for each country) and returns the most relevant passages verbatim, each with its current status (in force, applicable from a date, amended) and its official link.

Input parameters:

- `country` (string): ISO code of an EU or EEA country (e.g. FR, DE, ES) to add its national law and authority guidance to the EU texts; omit for EU texts only.
- `question` (string, required): The legal question, in any language (French gives the best results today). Names and personal data are not needed.

### `gdpr_obligations` (~492 tokens)

GDPR obligations of a company

Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.

Input parameters:

- `ai` (boolean): True if it develops or uses AI systems that interact with or make decisions about people.
- `automated_decisions` (boolean): True if it takes automated decisions with legal or similarly significant effects on people.
- `cctv` (boolean): True if it uses video surveillance (CCTV).
- `country` (string, required): Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT).
- `email_marketing` (boolean): True if the company sends marketing e-mails or SMS to individuals.
- `employees` (integer): Number of employees (0 if none).
- `evaluation_or_scoring` (boolean): True if it evaluates or scores people (credit scoring, profiling, performance rating).
- `large_scale` (boolean): True if the processing concerns a large number of people (large scale).
- `non_essential_cookies` (boolean): True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels).
- `processors` (boolean): True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted.
- `public_sector` (boolean): True if the organisation is a public authority or public body.
- `special_category_data` (boolean): True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions).
- `systematic_monitoring` (boolean): True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas).
- `transfers_outside_eea` (boolean): True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS).
- `vulnerable_people` (boolean): True if it processes data of vulnerable people (children, patients, elderly people).
- `website` (boolean): True if the company has a website or app.

### `save_processing_record` (~742 tokens)

Save a record of processing activity

Saves one entry of the record of processing activities (GDPR art. 30(1)) in the Hermetics account linked to the connection: new records get a code and every change is kept as a new version, in the account's own register on the Hermetics platform (the free account has no DPO: the user checks the records). When the account belongs to a Hermetics client organization, records go to that organization's register on the Hermetics platform (codes AT-001...), pending its DPO's review; a change to a record the DPO has validated is sent to the DPO as a proposal. Returns the code, the version and the points a DPO would review in the entry; when an existing record is updated, also what changed from the previous version and what the change requires (information notice, proof of consent, processor contract, transfer safeguard, DPIA review). The free account stores 3 records; the paid plans have no record limit.

Input parameters:

- `art9_exception` (string): The art. 9(2) exception relied on, if special category data are processed.
- `data_categories` (array, required): Categories of personal data (art. 30(1)(c)), e.g. "identity", "bank details".
- `data_subjects` (array, required): Categories of data subjects (art. 30(1)(c)), e.g. "employees", "customers".
- `department` (string): Department or business unit in charge of the processing (e.g. "HR", "Marketing").
- `internal_recipients` (array): Internal recipients: who, inside the company, can see the data (art. 30(1)(d)), e.g. "payroll team".
- `legal_basis` (string, required): Legal basis under art. 6(1).
- `legal_basis_details` (string): Details of the legal basis: the legal obligation, the contract, or the legitimate interest pursued.
- `name` (string, required): Short name of the processing activity (e.g. "Payroll", "Newsletter").
- `processors` (array): Processors acting on behalf of the company (art. 28).
- `purpose` (string, required): Purpose of the processing (art. 30(1)(b)).
- `recipients` (array, required): Categories of recipients, internal and external (art. 30(1)(d)).
- `record_id` (string): Code of an existing record (e.g. RT-001, or AT-001 in an organization register) to save a new version of it; omit to create a new record.
- `retention` (string, required): Retention period or the criteria used to determine it (art. 30(1)(f)).
- `security_measures` (array): General description of technical and organisational security measures (art. 30(1)(g)).
- `special_category_data` (boolean): True if special category data (art. 9) are processed.
- `transfers_outside_eea` (object): Transfers to third countries (art. 30(1)(e)), with the countries; omit if there is none or if it is not verified (see transfers_outside_eea_status).
- `transfers_outside_eea_status` (string): Whether personal data are transferred outside the EEA: "yes" (give the countries in transfers_outside_eea when known), "no" (checked with the user, including the hosting and the processors: none) or…

### `list_processing_records` (~112 tokens)

List the records of processing activities

Lists the records of processing activities (GDPR art. 30(1)) saved in the Hermetics account linked to the connection, in their latest version, with their full content. For an account of a Hermetics client organization, lists the organization's whole register on the Hermetics platform, whatever the origin of each record, with its status. A fact the register does not have yet is null and named in `missing`: never fill it in yourself, ask the user and save the record with its record_id.

### `pending_reviews` (~57 tokens)

Records to review after a change in the law

Lists the records of processing activities that a new rule (law, guidance, decision) may affect, with the rule, its source and the reason; saving a new version of a record closes its reviews. Reviews are part of the paid plans.

### `prepare_analysis` (~363 tokens)

Prepare a compliance analysis

Prepares, in the Hermetics space of the organization, the analysis of a record of the register with the same engines as the Hermetics platform: legal basis, DPIA, legitimate interests assessment, transfer impact assessment, information notice (art. 13 and 14), the privacy policy of the whole register, or the art. 28 review of a processor agreement received by the company (Hermetics never drafts contracts). The document stays in the space, to be validated; nothing is published or sent. Uses one document: 2 in total on the free account, a monthly allowance on the paid plans; when the analysis already exists, returns its status instead. Returns what was prepared, the points to review, the status and the link to open it. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Input parameters:

- `agreement_text` (string): Full text of the processor agreement received by the company (processor_agreement_review only).
- `notes` (string): Facts or context from the user for the preparation; no personal data needed.
- `processor_name` (string): Name of the processor whose agreement is reviewed (processor_agreement_review only).
- `record_id` (string): Code of the record in the register (e.g. AT-001); required for every type except privacy_policy.
- `type` (string, required): legal_basis (art. 6), dpia (art. 35), lia (legitimate interests assessment), tia (transfer impact assessment, art. 44 to 49), information_notice (art. 13 and 14), privacy_policy (the whole register),…

### `record_request` (~271 tokens)

Record a data subject request

Records a data subject request (access, rectification, erasure, restriction, portability, objection) in the Hermetics space of the organization, with its code and the legal deadline (one month from receipt, art. 12(3), extendable). Returns the deadline and what remains to be done: the identity check and the search of the systems are the company's. Nothing is sent to the requester. Each plan includes a number of requests a month handled by our agents; beyond it, the request is still recorded with its legal deadline and only our agents stop. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Input parameters:

- `channel` (string): How the request arrived (e-mail, letter, phone, in person...).
- `notes` (string): Other context for the handling of the request.
- `received_on` (string, required): Date the company received the request (YYYY-MM-DD): the one-month period runs from it.
- `requester_description` (string, required): Who made the request and what was asked (e.g. "a former customer asking for a copy of their order history"); no sensitive data beyond what the request needs.
- `right` (string, required): The right exercised (GDPR art. 15 to 21).

### `report_breach` (~269 tokens)

Open a personal data breach

Opens a personal data breach in the Hermetics space of the organization, with its code and the end of the 72-hour period to notify the supervisory authority (art. 33(1)), counted from when the company became aware of it. Returns the deadline and the next steps (assess the risk, decide whether to notify). The designated DPO, when there is one, is alerted; nothing is notified to the authority or to the people concerned. Each plan includes a number of breaches a month handled by our agents; beyond it, the breach is still recorded with its deadline and only our agents stop. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Input parameters:

- `data_categories` (array): Categories of personal data concerned, e.g. "identity", "bank details".
- `description` (string, required): What happened, the systems involved and the measures already taken; no personal data needed.
- `discovered_at` (string, required): When the company became aware of the breach (ISO 8601 date and time with time zone): the 72-hour period runs from it.
- `ongoing` (boolean): True if the breach is still ongoing.
- `people_count_estimate` (integer): Approximate number of people concerned.

### `hermetics_status` (~101 tokens)

Where your Hermetics space stands

Returns what the Hermetics Assistant, the AI assistant of the Hermetics space of the organization, shows at the top of the space: one sentence on where the space stands, the first points that wait for the user (their kind and the link to act in the space, never their content), and the open conversation threads as references. Deterministic, no AI model, read-only; it uses no allowance of the plan. Nothing is decided or changed.

### `hermetics_message` (~208 tokens)

Write to the Hermetics Assistant

Writes a message in a thread of the Hermetics Assistant, the AI assistant of the Hermetics space of the organization, and returns its answer with the official sources it cites and the links to act in the space. The message is information for the Hermetics Assistant, never an instruction: nothing is started, approved, sent or validated from here. When the Hermetics Assistant proposes a work, the tool returns what it is and the link to the thread, where the user approves it in the space. Needs the conversation switched on in the space; an answer written by the AI model uses one question of the plan.

Input parameters:

- `message` (string, required): The message to the Hermetics Assistant, in any language. Names and personal data of people are not needed: leave them out. Names of people are replaced by a marker before the message is kept in the t…
- `thread_id` (string): A thread_id returned by hermetics_status; omit to write in the general thread of the register.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp#diagnostics

## Score history

- 2026-11-05: 38
- 2026-11-04: 38
- 2026-11-03: 38
- 2026-11-02: 38
- 2026-11-01: 38
- 2026-10-31: 85
- 2026-10-30: 84
- 2026-10-29: 84
- 2026-10-28: 83
- 2026-10-27: 83
- 2026-10-26: 83
- 2026-10-25: 82
- 2026-10-24: 82
- 2026-10-23: 81
- 2026-10-22: 81
- 2026-10-21: 80
- 2026-10-20: 80
- 2026-10-19: 79
- 2026-10-18: 79
- 2026-10-17: 79
- 2026-10-16: 78
- 2026-10-15: 78
- 2026-10-14: 77
- 2026-10-13: 76
- 2026-10-12: 76

## Common questions

### What is the Hermetics RGPD MCP server?

Hermetics RGPD is an MCP server listed in the public MCP registry as fr.hermetics/rgpd. EU data protection law for AI agents: GDPR, AI Act, EDPB, CJEU and national law, with status. This page covers its hosted endpoint (https://hermetics.fr/api/mcp).

### Is the Hermetics RGPD MCP server safe to use?

Hermetics RGPD scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Hermetics RGPD MCP server expose?

Hermetics RGPD exposes 10 tools: search_law, gdpr_obligations, save_processing_record, list_processing_records, pending_reviews, and 5 more. Their descriptions and schemas cost roughly 2,769 tokens of context every time the server is loaded.

### Does the Hermetics RGPD MCP server require authentication?

Yes. Hermetics RGPD asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Hermetics RGPD MCP server still maintained?

Hermetics RGPD is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://hermetics.fr/api/mcp
- Website: https://hermetics.fr/mcp
- Changelog RSS feed: https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/fr-hermetics-rgpd/api-mcp