VITNA — Agent Compliance Preflight

NPM · @COSTRINITY/VITNA-COMPLIANCE-MCP · 2 COMPONENTS · SCANNED AUG 20

Pre-action allow/deny for AI agents. 24 statutes, 13 jurisdictions: EU AI Act, GDPR, DPDP.

Available components

remote · vitna.costrinity.xyz 65 npm · @costrinity/vitna-compliance-mcp 67

+4 this week 67 67 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security100

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
No production dependencies, so there is no dependency health to assess. View diagnostics → Pass

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 2229 tokens (~101/item across 22 items; 22 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage74

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
22% of tool parameters carry a description.Partial

Capabilities20

Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @costrinity/vitna-compliance-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add xyz-costrinity-vitna-compliance-preflight -- npx -y @costrinity/vitna-compliance-mcp

# add to Codex CLI

codex mcp add xyz-costrinity-vitna-compliance-preflight -- npx -y @costrinity/vitna-compliance-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyz-costrinity-vitna-compliance-preflight": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@costrinity/vitna-compliance-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add xyz-costrinity-vitna-compliance-preflight --command npx --arg -y --arg @costrinity/vitna-compliance-mcp

# ~/.hermes/config.yaml

mcp_servers:
  xyz-costrinity-vitna-compliance-preflight:
    command: "npx"
    args: ["-y", "@costrinity/vitna-compliance-mcp"]

// mcp.json

{
  "mcpServers": {
    "xyz-costrinity-vitna-compliance-preflight": {
      "command": "npx",
      "args": [
        "-y",
        "@costrinity/vitna-compliance-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

20 Aug 26 +15
- Malware scan: unverified → pass ▲ security
19 Aug 26 −11
- Malware scan: pass → unverified ▼ security
- Security disclosure: unverified → fail ▼ functional
- Stability: unverified → 0.27 ▲ functional
- Package version: 0.3.4 → 0.3.6 functional
18 Aug 26 0
- Security disclosure: fail → unverified ▼ functional
11 Aug 26 63

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Aug 2026 · Analysed npm/@costrinity/vitna-compliance-mcp@0.3.6

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	npm

Dependencies 0 packages

Packages resolved	0
Tree resolution	Complete

MCP tools · 22 exposed · ~2,229 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

aadhaar_mask ~63

Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
aadhaar	string	yes	–

No output schema declared.

No examples provided.

ai_act_classify ~187

Before you build or ship an AI feature, check where it lands under the EU AI Act (Regulation 2024/1689). Describe the use case (with biometric / remote-identification / automated-decision / social-scoring / GPAI flags) and VITNA returns the risk tier (prohibited / high-risk / limited-risk / minimal-risk), GPAI obligations, and the per-tier obligations you would have to meet. A classification for you to act on: VITNA evaluates and records, it does not gate the build.

Input Output Examples

Name	Type	Req	Description
automated_decisions	boolean	–	–
biometric	boolean	–	–
data_categories	array	–	–
general_purpose_ai	boolean	–	–
remote_identification	boolean	–	–
sectors	array	–	–
social_scoring	boolean	–	–
use_case	string	yes	–

No output schema declared.

No examples provided.

breach_classify ~197

After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts (affected count, data categories, sensitivity, recovery state) and VITNA returns reportability + reasoning + the notification deadline + who to notify, across DPDP §8, GDPR Art 33, CPRA §1798.82, LGPD Art 48, PDPA §26B, and US-FED sectoral. This makes the full incident decision from the facts; for a quick per-US-state deadline/recipient/threshold table without incident facts, use us_state_breach_deadline. VITNA evaluates and records; acting on the result is up to you.

Input Output Examples

Name	Type	Req	Description
affected_count	integer	yes	–
data_categories	array	yes	–
jurisdiction	string	–	–
processing_purpose	string	–	–
recovery_state	string	yes	–
sensitivity	string	yes	–

No output schema declared.

No examples provided.

consent_check ~166

Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and optional category); returns { allowed, reason, matching_consent_id, principal_id }, a determination you must honour yourself since VITNA evaluates and records but does not enforce. Use this for personal-data processing legality; for a dangerous technical action (shell / file / DB / network) use action_preflight instead.

Input Output Examples

Name	Type	Req	Description
category	string	–	Optional permitted-category check.
principal_id	string	–	UUID of the data principal (if known).
principal_ref	string	–	Operator-side identifier; will be SHA-256-hashed.
purpose	string	yes	Purpose code (e.g. 'operational_observability').

No output schema declared.

No examples provided.

cpf_validate ~44

Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
cpf	string	yes	–

No output schema declared.

No examples provided.

dpia_threshold_check ~166

Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categories (and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags); returns dpia_required + the 9-criterion WP29 analysis + jurisdiction guidance, so you know whether to pause and assess before proceeding.

Input Output Examples

Name	Type	Req	Description
automated_decision	boolean	–	–
cross_border	boolean	–	–
data_categories	array	yes	–
jurisdiction	string	–	–
processing_purpose	string	yes	–
scale	string	–	–
systematic_monitoring	boolean	–	–
vulnerable_subjects	boolean	–	–

No output schema declared.

No examples provided.

global_compliance_map ~48

Master catalogue of every privacy/security/sectoral regime VITNA has fabric for (28 entries covering 24 named statutes). Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

gstin_validate ~47

Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
gstin	string	yes	–

No output schema declared.

No examples provided.

iban_validate ~49

Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
iban	string	yes	–

No output schema declared.

No examples provided.

india_cross_border_status ~101

Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code (e.g. US). Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
country	string	yes	ISO-3166 alpha-2 (e.g. US).

No output schema declared.

No examples provided.

india_regulators_directory ~103

Static reference directory of Indian data and sector regulators (DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA), optionally filtered by sector: a lookup of who exists and what they cover. To instead work out which of them apply to a specific processing activity, use india_sectoral_check. Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
sector	string	–	–

No output schema declared.

No examples provided.

india_sectoral_check ~128

Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PFRDA) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a plain directory of every Indian regulator regardless of your activity, use india_regulators_directory.

Input Output Examples

Name	Type	Req	Description
counterparty_types	array	–	–
data_categories	array	yes	–
processing_purpose	string	yes	–
sector_hint	string	–	–

No output schema declared.

No examples provided.

japan_cross_border_status ~78

Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
country	string	yes	ISO-3166 alpha-2.

No output schema declared.

No examples provided.

pan_classify ~61

Classify a PAN entity type from the 4th character (P=Person, C=Company, H=HUF, F=Firm, ...). Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
pan	string	yes	–

No output schema declared.

No examples provided.

pii_test ~102

Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether severity would escalate. Nothing is persisted and nothing is filtered: a safe rehearsal you act on, not an enforced gate — it records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
jurisdiction	string	–	–
sample_event	object	yes	event_type / message / payload fields.

No output schema declared.

No examples provided.

privacy_notice_get ~45

Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Stateless generator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
format	string	–	–

No output schema declared.

No examples provided.

sin_validate ~44

Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
sin	string	yes	–

No output schema declared.

No examples provided.

sub_processors_register ~42

Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

us_sectoral_check ~124

Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india_sectoral_check.

Input Output Examples

Name	Type	Req	Description
ai_decisions	boolean	–	–
counterparty_types	array	–	–
data_categories	array	yes	–
has_revenue_threshold	boolean	–	–
processing_purpose	string	yes	–

No output schema declared.

No examples provided.

us_state_breach_deadline ~120

Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold (e.g. 'CA' gives 500 residents, CA AG, without unreasonable delay). This is a static table, not an incident ruling. When you have the actual incident facts and need a reportable / not-reportable decision with reasoning, use breach_classify instead. Stateless lookup: records no decision and leaves no dashboard timeline trace.

Input Output Examples

Name	Type	Req	Description
state	string	yes	US 2-letter state code (CA, NY, TX, ...).

No output schema declared.

No examples provided.

vitna_help ~91

What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check risky actions BEFORE running them, what a deny / hold decision means, trial vs claimed mode, and how the user can monitor and audit what you do. Runs entirely locally: no account, no API call, and no dashboard timeline trace.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

vitna_preflight ~223

SAFETY / OVERSIGHT CHECK before a dangerous or destructive action (shell command, file deletion, DB statement, network call). Call this to have VITNA check the action BEFORE you run it: it flags dangerous shell / SQL / secret-exfil / prompt-injection / suspicious-network patterns and returns { decision: allowed|blocked|flagged, threat_category, reason } plus (in claimed mode) a signed audit record the user can review. VITNA evaluates and records; it does NOT enforce, so treat blocked / flagged as a stop and get human approval. This is how a user keeps you in check. Heuristic pattern match, not a sandbox: novel or obfuscated payloads can pass.

Input Output Examples

Name	Type	Req	Description
action	string	–	The proposed action / command text, e.g. "rm -rf /" or "DROP TABLE users".
action_type	string	–	Optional short label for the action kind (shell, file_delete, db_query, network).
payload	object	–	Optional structured payload to scan alongside the action text.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

11 Aug 20 Aug

Day	Score
11 Aug	63
12 Aug	63
13 Aug	63
14 Aug	63
15 Aug	63
16 Aug	63
17 Aug	63
18 Aug	63
19 Aug	52
20 Aug	67