Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.
Tamper-evident audit trail MCP server for EU AI Act and GDPR compliance. Designed to be integrated into a local desktop application via stdio transport.
This server implements technical measures for the following EU regulations:
| Regulation | Articles | What it requires |
|---|---|---|
| EU AI Act (2024/1689) | Art. 12 | Automatic recording of events (logs) for high-risk AI systems |
| Art. 19 | Retention of automatically generated logs for at least 6 months | |
| GDPR (2016/679) | Art. 17 | Right to erasure of personal data ("right to be forgotten") |
| Art. 30 | Records of processing activities, including purposes and data categories |
The EU AI Act high-risk obligations enter into force on 2 August 2026.
See LEGAL_REFERENCES.md for the full article texts and a detailed mapping of how each tool addresses each requirement.
Disclaimer: This tool provides a technical checklist, not legal advice. Consult qualified legal counsel for compliance decisions.
pip install -e ".[dev]"
python -m eu_audit_mcp.server
{
"mcpServers": {
"eu-audit": {
"command": "python",
"args": ["-m", "eu_audit_mcp.server"],
"env": {
"AUDIT_CONFIG": "./audit_config.yaml"
}
}
}
}
pytest tests/
| Tool | Description |
|---|---|
log_event | Record an audit event with automatic PII scanning |
log_inference | Log an LLM inference call (model, tokens, cost) |
log_data_access | Log a document/data access event |
query_log | Search events by time range, type, session |
get_session_trace | Full ordered trace of a session |
get_stats | Summary statistics over a time period |
compliance_check | Check against EU AI Act Art. 12/19 and GDPR Art. 30 |
execute_erasure | GDPR Article 17 right-to-erasure |
get_pii_summary | Summary of detected PII types (counts only) |
verify_chain | Verify hash chain integrity |
Copy the example config and customize:
cp audit_config.example.yaml audit_config.yaml
Set the AUDIT_CONFIG environment variable to point to your config file. Do not commit audit_config.yaml if it contains a chain_secret — it is in .gitignore by default.
See SECURITY.md for the threat model, security measures, and vulnerability reporting.
Apache-2.0
Source-derived launch command. Check the maintainer’s required arguments and credentials before running:
uvx eu-audit-mcpMerge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.
{
"mcpServers": {
"io-github-jellewas-eu-audit-mcp": {
"command": "uvx",
"args": [
"eu-audit-mcp"
]
}
}
}Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.
Claude Desktop setup referenceeu-audit-mcppypiEU Audit Trail works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.
~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.~/.cursor/mcp.jsonRestart Cursor for changes to take effect..vscode/mcp.jsonReload VS Code window for changes to take effect.~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect..mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.