# io.github.uchit/mcp-regulated-ai-compliance (npm · @hellouchit/mcp-regulated-ai-compliance)

Regulated-industry AI compliance: EU AI Act, APRA, NIST AI RMF, ISO 42001, AU AI Safety.

- Trust score: 81/100 (high trust)
- Change this week: +28
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@hellouchit/mcp-regulated-ai-compliance`: 81/100 (this document), [markdown](https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance.md), [page](https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance)

## Channel facts

- Registry: `npm`
- Package: `@hellouchit/mcp-regulated-ai-compliance`
- Version: `0.2.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to uchit/mcp-regulated-ai-compliance).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 57 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3111 tokens (~50/item across 62 items; 6 tools + 56 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add uchit-mcp-regulated-ai-compliance -- npx -y @hellouchit/mcp-regulated-ai-compliance
```

### Codex

```bash
codex mcp add uchit-mcp-regulated-ai-compliance -- npx -y @hellouchit/mcp-regulated-ai-compliance
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "uchit-mcp-regulated-ai-compliance": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@hellouchit/mcp-regulated-ai-compliance"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add uchit-mcp-regulated-ai-compliance --command npx --arg -y --arg @hellouchit/mcp-regulated-ai-compliance
```

### Hermes

```yaml
mcp_servers:
  uchit-mcp-regulated-ai-compliance:
    command: "npx"
    args: ["-y", "@hellouchit/mcp-regulated-ai-compliance"]
```

### Other

```json
{
  "mcpServers": {
    "uchit-mcp-regulated-ai-compliance": {
      "command": "npx",
      "args": [
        "-y",
        "@hellouchit/mcp-regulated-ai-compliance"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 81, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 77, +57)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: uchit/mcp-regulated-ai-compliance
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 20, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 5, −30)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 35, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (6)

### `lookup_control` (~492 tokens)

Look up which security/compliance controls apply for a given regulation, control category, enforcement surface, and/or sector.

Each result includes: the named control, the regulations that mandate it, the tooling options that implement it (categorised as managed/oss/commercial/standard), the evidence shape an auditor would expect, sector relevance, and a practitioner note.

Sourced from the curated dataset at hellouchit.com/dataset/ (CC BY 4.0). Covers EU AI Act, NIST AI RMF, ISO/IEC 42001, APRA CPS 234/230, AU AI Safety Standard, ASD Essential Eight, IRAP, SLSA, NIST SSDF, OWASP LLM Top 10, MITRE ATLAS, BCBS 239, PCI DSS 4.0, HIPAA, GDPR, EU DORA, EU NIS2, CISA SSA, FDA SaMD, IEC 62443, and more.

Use this tool whenever you need to answer 'which tool closes X regulator's requirement on Y surface' or 'what evidence does Z compliance regime expect'.

Input parameters:

- `category` (string): Control category. Examples: 'Identity & access', 'Supply chain & provenance', 'AI evals & guardrails', 'Data governance', 'Cryptography & secrets', 'Resilience & continuity'
- `limit` (integer): Maximum number of matches to return (default 10)
- `regulation` (string): Regulation slug. One of: cps234, cps230, soci, ai_safety_au, privacy_au, e8, irap, eu_ai_act, dora, nis2, gdpr, circia, hipaa, fda_samd, cisa_ssa, ssdf, ai_rmf, sp80053, iso42001, iso27001, slsa, owa…
- `search` (string): Free-text search over control names + notes + evidence shape
- `sector` (string): Sector filter. One of: banks, government, healthcare, critical-infrastructure, all
- `surface` (string): Enforcement surface keyword (case-insensitive substring match). Examples: 'Cloud', 'CI/CD', 'K8s', 'Network', 'Runtime', 'Source'

### `get_anti_pattern` (~198 tokens)

Look up anti-patterns from the catalogue at hellouchit.com/anti-patterns/ — named failure modes that recur across regulated-industry tech delivery.

Each match returns: where the pattern appears, why it's bad, what to do instead, and a diagnostic 'tell' that surfaces it. Examples: 'Inline Prompt Pattern', 'AI CoE Trap', 'Vault Theatre', 'SBOM Shelfware', 'PDF Principles', 'Eval Set That Never Runs'.

Use when reviewing an architecture description or codebase to flag known failure shapes; or when you need to name a problem precisely for a stakeholder conversation.

Input parameters:

- `list_all` (boolean): If true, ignore query and return all known anti-patterns. Useful for catalogue browsing.
- `query` (string, required): Search query. Can be a name ('AI CoE Trap'), slug ('vault-theatre'), or keyword ('inline prompt', 'static credentials'). Case-insensitive substring search.

### `crosswalk` (~355 tokens)

Map a regulatory requirement to its equivalents across other frameworks. Covers: EU AI Act ↔ NIST AI RMF ↔ ISO/IEC 42001 ↔ AU AI Safety Standard ↔ APRA CPS 230/234 ↔ OECD AI Principles ↔ Council of Europe Framework Convention on AI ↔ GDPR ↔ SLSA ↔ NIST SSDF ↔ OWASP LLM Top 10.

Each mapping has overlap classification (FULL · PARTIAL · NEW) plus practitioner notes on why.

Use whenever a user has work in one framework and needs to know what carries over to another. Highest-leverage when multinationals operating across jurisdictions need to demonstrate 'work done once counts everywhere'.

Source data maintained at hellouchit.com/dataset/. Set list_all_frameworks=true to see the framework catalogue first if you're unsure of the slugs.

Input parameters:

- `from_framework` (string): Source framework slug (e.g. 'eu_ai_act', 'au_ai_safety', 'nist_ai_rmf', 'iso_42001', 'apra_cps_230', 'ssdf'). If omitted with from_reference, searches across all frameworks.
- `from_reference` (string): Source requirement reference (e.g. 'Article 9', 'G2', 'MAP 1.1', 'A.6.1', '§13', 'PS.3'). Case-insensitive substring match against entry references.
- `list_all_frameworks` (boolean): If true, ignore other parameters and return the framework catalogue.
- `overlap_filter` (string): Filter results by overlap strength.
- `to_frameworks` (array): Target frameworks to map TO. If omitted, returns mappings to all available target frameworks.

### `walk_playbook` (~287 tokens)

Return a structured 90-day playbook (or specific week/gate from one). Playbooks are sequenced from week 1 to week 12, organised into 3 phases, with 12 named gates and anti-pattern callouts.
Available playbooks:
\- eu-ai-act-12-weeks: From 'Piloting' to EU AI Act Articles 9-15 ready by 2 Aug 2026
\- cisa-attestation-90-days: From 'some SSDF practices' to defensible CISA Secure Software Attestation
\- cloud-cost-aware-to-controlled: From 5-12% YoY savings to 20-35% (FinOps Aware → Controlled)
\- vault-theatre-to-workload-identity: From static-creds-in-vault to OIDC workload identity
Use to walk a user through implementation sequentially, or to extract a specific gate's requirements.

Input parameters:

- `include_metadata` (boolean): Include playbook-level metadata (audience, prerequisites, end-state, diagnostic to re-run).
- `playbook` (string, required): Playbook slug. Available: eu-ai-act-12-weeks · cisa-attestation-90-days · cloud-cost-aware-to-controlled · vault-theatre-to-workload-identity
- `week` (integer): Specific week number (1-12). If omitted, returns the full playbook structure with metadata.

### `classify_use_case` (~203 tokens)

Classify an AI use-case under EU AI Act (Annex III + Article 5) and optionally AU AI Safety Standard.

Returns: risk tier, matching Annex III categories with sub-points, applicable Articles 9-15 obligations, enforcement date, and a recommended next-step sequence (which other tools to call).

Use for: initial classification of a new use-case, dual-jurisdiction analysis (EU + AU), or generating a structured input for the human-counsel-review handoff.

Not a substitute for legal counsel — borderline cases (especially employment, essential services, credit) need qualified review.

Input parameters:

- `description` (string, required): Free-text AI use-case description. Be specific about: what the AI does, who it affects, what decisions it influences, what data it uses. Minimum 20 chars.
- `jurisdictions` (array): Jurisdictions to classify against. Default: EU AI Act only. Pass ['EU','AU'] for dual-framework classification.

### `list_regulations` (~110 tokens)

Return the regulations covered by the dataset. Useful as a discovery step — call this first to find available regulation slugs before calling lookup_control or crosswalk.

Each entry includes: slug (for use with other tools), full label, jurisdiction (AU/EU/US/INTL), and the count of control rows that reference it.

Input parameters:

- `include_row_count` (boolean): Include how many control rows in the dataset reference each regulation.
- `jurisdiction` (string): Filter by jurisdiction. Default: all.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance#diagnostics

## Score history

- 2026-08-03: 81
- 2026-08-02: 77
- 2026-08-01: 20
- 2026-07-31: 5
- 2026-07-30: 35
- 2026-07-28: 53
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/@hellouchit/mcp-regulated-ai-compliance
- Socket report: https://socket.dev/npm/package/@hellouchit/mcp-regulated-ai-compliance
- Repository: https://github.com/uchit/mcp-regulated-ai-compliance
- Website: https://hellouchit.com/
- Changelog RSS feed: https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance/changelog.json
- HTML version of this page: https://verifymcp.io/servers/uchit-mcp-regulated-ai-compliance/hellouchit-mcp-regulated-ai-compliance