MCP Radar
Servidor MCP

VITNA — Agent Compliance Preflight

xyz.costrinity/vitna-compliance-preflight
Legal y cumplimiento Seguridad Público y accesible MCP 2026-07-28

Qué hace este MCP

Provides privacy, AI regulation, breach, sectoral compliance, identity validation, consent, DPIA, and pre-action safety checks.

Capacidades

Herramientas

23 herramientas
aadhaar_mask
Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['aadhaar'], 'properties': {'aadhaar': {'type': 'string'}}}
ai_act_classify
Before you build or ship an AI feature, check where it lands under the EU AI Act (Regulation 2024/1689). Describe the use case (with biometric / remote-identification / automated-decision / social-scoring / GPAI flags) and VITNA returns the risk tier (prohibited / high-risk / limited-risk / minimal-risk), GPAI obligations, and the per-tier obligations you would have to meet. A classification for you to act on: VITNA evaluates and records, it does not gate the build.
Esquema de entrada 
{'type': 'object', 'required': ['use_case'], 'properties': {'sectors': {'type': 'array', 'items': {'type': 'string'}}, 'use_case': {'type': 'string'}, 'biometric': {'type': 'boolean'}, 'social_scoring': {'type': 'boolean'}, 'data_categories': {'type': 'array', 'items': {'type': 'string'}}, 'general_purpose_ai': {'type': 'boolean'}, 'automated_decisions': {'type': 'boolean'}, 'remote_identification': {'type': 'boolean'}}}
breach_classify
After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts (affected count, data categories, sensitivity, recovery state) and VITNA returns reportability + reasoning + the notification deadline + who to notify, across DPDP §8, GDPR Art 33, CPRA §1798.82, LGPD Art 48, PDPA §26B, and US-FED sectoral. This makes the full incident decision from the facts; for a quick per-US-state deadline/recipient/threshold table without incident facts, use us_state_breach_deadline. VITNA evaluates and records; acting on the result is up to you.
Esquema de entrada 
{'type': 'object', 'required': ['affected_count', 'data_categories', 'sensitivity', 'recovery_state'], 'properties': {'sensitivity': {'enum': ['low', 'medium', 'high', 'special'], 'type': 'string'}, 'jurisdiction': {'type': 'string'}, 'affected_count': {'type': 'integer'}, 'recovery_state': {'enum': ['lost', 'exposed', 'altered', 'destroyed', 'contained'], 'type': 'string'}, 'data_categories': {'type': 'array', 'items': {'type': 'string'}}, 'processing_purpose': {'type': 'string'}}}
consent_check
Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and optional category); returns { allowed, reason, matching_consent_id, principal_id }, a determination you must honour yourself since VITNA evaluates and records but does not enforce. Use this for personal-data processing legality; for a dangerous technical action (shell / file / DB / network) use vitna_preflight instead.
Esquema de entrada 
{'type': 'object', 'required': ['purpose'], 'properties': {'purpose': {'type': 'string', 'description': "Purpose code (e.g. 'operational_observability')."}, 'category': {'type': 'string', 'description': 'Optional permitted-category check.'}, 'principal_id': {'type': 'string', 'description': 'UUID of the data principal (if known).'}, 'principal_ref': {'type': 'string', 'description': 'Operator-side identifier; will be SHA-256-hashed.'}}}
cpf_validate
Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['cpf'], 'properties': {'cpf': {'type': 'string'}}}
dpia_threshold_check
Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categories (and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags); returns dpia_required + the 9-criterion WP29 analysis + jurisdiction guidance, so you know whether to pause and assess before proceeding.
Esquema de entrada 
{'type': 'object', 'required': ['processing_purpose', 'data_categories'], 'properties': {'scale': {'enum': ['small', 'medium', 'large', 'mass'], 'type': 'string'}, 'cross_border': {'type': 'boolean'}, 'jurisdiction': {'type': 'string'}, 'data_categories': {'type': 'array', 'items': {'type': 'string'}}, 'automated_decision': {'type': 'boolean'}, 'processing_purpose': {'type': 'string'}, 'vulnerable_subjects': {'type': 'boolean'}, 'systematic_monitoring': {'type': 'boolean'}}}
global_compliance_map
Master catalogue of every privacy/security/sectoral regime VITNA has fabric for (28 entries covering 24 named statutes). Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'properties': {}}
gstin_validate
Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['gstin'], 'properties': {'gstin': {'type': 'string'}}}
iban_validate
Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['iban'], 'properties': {'iban': {'type': 'string'}}}
india_cross_border_status
Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code (e.g. US). Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['country'], 'properties': {'country': {'type': 'string', 'description': 'ISO-3166 alpha-2 (e.g. US).'}}}
india_regulators_directory
Static reference directory of Indian data and sector regulators (DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA), optionally filtered by sector: a lookup of who exists and what they cover. To instead work out which of them apply to a specific processing activity, use india_sectoral_check. Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'properties': {'sector': {'type': 'string'}}}
india_sectoral_check
Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PFRDA) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a plain directory of every Indian regulator regardless of your activity, use india_regulators_directory.
Esquema de entrada 
{'type': 'object', 'required': ['processing_purpose', 'data_categories'], 'properties': {'sector_hint': {'type': 'string'}, 'data_categories': {'type': 'array', 'items': {'type': 'string'}}, 'counterparty_types': {'type': 'array', 'items': {'type': 'string'}}, 'processing_purpose': {'type': 'string'}}}
japan_cross_border_status
Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['country'], 'properties': {'country': {'type': 'string', 'description': 'ISO-3166 alpha-2.'}}}
pan_classify
Classify a PAN entity type from the 4th character (P=Person, C=Company, H=HUF, F=Firm, ...). Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['pan'], 'properties': {'pan': {'type': 'string'}}}
pii_test
Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether severity would escalate. Nothing is persisted and nothing is filtered: a safe rehearsal you act on, not an enforced gate — it records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['sample_event'], 'properties': {'jurisdiction': {'type': 'string'}, 'sample_event': {'type': 'object', 'description': 'event_type / message / payload fields.'}}}
privacy_notice_get
Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Stateless generator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'properties': {'format': {'enum': ['md', 'json'], 'type': 'string'}}}
sin_validate
Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['sin'], 'properties': {'sin': {'type': 'string'}}}
sub_processors_register
Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'properties': {}}
us_sectoral_check
Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india_sectoral_check.
Esquema de entrada 
{'type': 'object', 'required': ['processing_purpose', 'data_categories'], 'properties': {'ai_decisions': {'type': 'boolean'}, 'data_categories': {'type': 'array', 'items': {'type': 'string'}}, 'counterparty_types': {'type': 'array', 'items': {'type': 'string'}}, 'processing_purpose': {'type': 'string'}, 'has_revenue_threshold': {'type': 'boolean'}}}
us_state_breach_deadline
Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold (e.g. 'CA' gives 500 residents, CA AG, without unreasonable delay). This is a static table, not an incident ruling. When you have the actual incident facts and need a reportable / not-reportable decision with reasoning, use breach_classify instead. Stateless lookup: records no decision and leaves no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'required': ['state'], 'properties': {'state': {'type': 'string', 'description': 'US 2-letter state code (CA, NY, TX, ...).'}}}
vitna_claim
Ask whether this VITNA account has been claimed by a real person yet, and get the link that claims it. Call this when the user asks about their VITNA account, when you are told evidence is not being kept, or any time you want to hand the user something actionable. Returns { claimed, claim_url, what_claiming_gets_you }. IMPORTANT: if claimed is false, show the user the claim_url verbatim -- it is a one-time link that only they can act on, the account's evidence is NOT being durably recorded until they do, and they cannot find this link anywhere else. Do not paraphrase the URL and do not withhold it.
Esquema de entrada 
{'type': 'object', 'properties': {}}
vitna_help
What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check risky actions BEFORE running them, what a deny / hold decision means, trial vs claimed mode, and how the user can monitor and audit what you do. Runs entirely locally: no account, no API call, and no dashboard timeline trace.
Esquema de entrada 
{'type': 'object', 'properties': {}}
vitna_preflight
SAFETY / OVERSIGHT CHECK before a dangerous or destructive action (shell command, file deletion, DB statement, network call). Call this to have VITNA check the action BEFORE you run it: it flags dangerous shell / SQL / secret-exfil / prompt-injection / suspicious-network patterns and returns { decision: allowed|blocked|flagged }. RESPONSE SHAPE DEPENDS ON THE KEY: an unclaimed trial key gets the decision label only, because the pattern detail is what makes the classifier worth stealing. A claimed key additionally gets threat_category, severity, reason (the rule names that matched, never the matched text), a threats[] array and a redacted echo of what was scanned, plus a signed audit record the user can review. VITNA evaluates and records; it does NOT enforce, so treat blocked / flagged as a stop and get human approval. This is how a user keeps you in check. Heuristic pattern match, not a sandbox: novel or obfuscated payloads can pass.
Esquema de entrada 
{'type': 'object', 'properties': {'action': {'type': 'string', 'description': 'The proposed action / command text, e.g. "rm -rf /" or "DROP TABLE users".'}, 'payload': {'type': 'object', 'description': 'Optional structured payload to scan alongside the action text.'}, 'action_type': {'type': 'string', 'description': 'Optional short label for the action kind (shell, file_delete, db_query, network).'}}}
Historial

Cambios recientes en herramientas

Añadido
vitna_preflight
17 de September de 2026 a las 12:55
Añadido
india_regulators_directory
17 de September de 2026 a las 12:55
Añadido
global_compliance_map
17 de September de 2026 a las 12:55
Añadido
sub_processors_register
17 de September de 2026 a las 12:55
Añadido
privacy_notice_get
17 de September de 2026 a las 12:55
Añadido
pii_test
17 de September de 2026 a las 12:55
Añadido
iban_validate
17 de September de 2026 a las 12:55
Añadido
sin_validate
17 de September de 2026 a las 12:55
Añadido
cpf_validate
17 de September de 2026 a las 12:55
Añadido
gstin_validate
17 de September de 2026 a las 12:55
Añadido
pan_classify
17 de September de 2026 a las 12:55
Añadido
aadhaar_mask
17 de September de 2026 a las 12:55
Añadido
us_state_breach_deadline
17 de September de 2026 a las 12:55
Añadido
japan_cross_border_status
17 de September de 2026 a las 12:55
Añadido
india_cross_border_status
17 de September de 2026 a las 12:55
Añadido
india_sectoral_check
17 de September de 2026 a las 12:55
Añadido
us_sectoral_check
17 de September de 2026 a las 12:55
Añadido
dpia_threshold_check
17 de September de 2026 a las 12:55
Añadido
ai_act_classify
17 de September de 2026 a las 12:55
Añadido
breach_classify
17 de September de 2026 a las 12:55
Añadido
consent_check
17 de September de 2026 a las 12:55
Añadido
vitna_claim
17 de September de 2026 a las 12:55
Añadido
vitna_help
17 de September de 2026 a las 12:55
Descubrir

Servidores MCP similares

DataNexus MCP

com.datanexusmcp/mcp-server

Enables public-data research across domains, patents, government contracts, nonprofits, compliance registries, and software secur…

ampel

io.tooloracle/ampel

Assesses regulated entities and providers against DORA and related ESG, MiCA, and AML requirements, with contract analysis, evide…

predictionguard

io.tooloracle/predictionguard

Analyzes Polymarket and Kalshi markets for insider-trading signals, market integrity risks, sanctions and PEP exposure, conflicts…

Nist Standards

io.github.pipeworx-io/nist-standards

Searches and retrieves NIST SP 800-53 security controls and SP 800-171 CUI requirements, including requirements, guidance, and co…

Sanctions Screening

io.github.pipeworx-io/sanctions-screening

Screens names against US sanctions and export-control lists and retrieves detailed sanctions records.

Dilisense

io.github.pipeworx-io/dilisense

Screens individuals and organizations against sanctions, PEP, criminal, and adverse-watchlist data for AML and KYC checks.

Open Sanctions

io.github.pipeworx-io/open-sanctions

Looks up sanctioned and politically exposed entities, including identifiers, aliases, addresses, sanctions programs, and relation…

Sanctions Io

io.github.pipeworx-io/sanctions-io

Screens individuals and organizations in bulk against sanctions, politically exposed person, and watchlists.