Skip to content
Agentmart
Submit a tool

GDPR Shift-Left Compliance

GDPR compliance MCP server - article lookup, DPIA, ROPA, DSR, IaC analysis, Bicep templates.

Connector by KevinRabun · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 2
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/kevinrabun-gdprshiftleftmcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

GDPR compliance MCP server - article lookup, DPIA, ROPA, DSR, IaC analysis, Bicep templates.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
27 read · 0 write · 0 delete · 7 not yet classified
Secrets
None asked for
Install scripts
Not scanned yet
Runs as
Python package

Tools by what they do 34

Read from the source code; the running server may list different tools.

Read 27 · Look things up without changing anything.

  • analyze_application_code
  • analyze_breach_readiness
  • analyze_code_ast
  • analyze_code_for_role_indicators
  • analyze_cross_border_transfers
  • analyze_data_flow
  • analyze_dsr_capabilities
  • analyze_infrastructure_code
  • check_deletion_requirements
  • get_article
  • get_ast_capabilities
  • get_azure_mapping
Show 15 more tools
  • get_definition
  • get_dpia_guidance
  • get_dsr_guidance
  • get_dsr_timeline
  • get_recital
  • get_retention_guidance
  • get_role_obligations
  • get_role_scenarios
  • get_ropa_requirements
  • list_chapter_articles
  • list_definitions
  • search_definitions
  • search_gdpr
  • validate_gdpr_config
  • validate_ropa

Not yet classified 7 · We could not tell from the name and description.

  • assess_controller_processor_role
  • assess_dpia_need
  • assess_retention_policy
  • generate_dpa_checklist
  • generate_dpia_template
  • generate_dsr_workflow
  • generate_ropa_template

Files it touches

  • Any path the agent passes to its tools

Tools (34)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • analyze_application_code

    Analyze application code for GDPR compliance issues such as missing consent checks, PII logging, insecure data handling, and missing encryption. Args: code: The application code content language: 'python', 'csharp', 'java', 'typescript', or 'javascript' file_path: Optional file path for reporting

  • analyze_breach_readiness

    Analyze code for breach notification readiness under GDPR Art. 33-34. Assesses: - Security logging capabilities - Alerting mechanisms - Incident tracking systems - 72-hour notification process references - Data subject notification capabilities Args: code: The application code content language: Programming language ('python', 'typescript', 'csharp', etc.) file_path: Optional file path for reporting

  • analyze_code_ast

    Analyze code using AST for GDPR compliance (Python, JavaScript, TypeScript). AST analysis provides higher accuracy than regex by: - Filtering out comments and string literals (reducing false positives) - Tracking variable assignments and data flow - Identifying function definitions and call sites - Verifying semantic intent of GDPR-related code Detects: - Cross-border data transfers (third-party API imports) - PII handling in function parameters - PII logging violations - DSR implementation patterns (Art. 15-22) Args: code: Source code to analyze file_path: Optional file path for au…

  • analyze_code_for_role_indicators

    Analyze source code for patterns indicating controller vs processor role. Detects patterns like: direct user data collection, consent mechanisms, multi-tenant isolation, webhook receivers, data forwarding, etc. Args: code: The source code to analyze language: Programming language ('python', 'typescript', 'csharp', etc.)

  • analyze_cross_border_transfers

    Analyze code for potential cross-border data transfers under GDPR Chapter V. Detects: - Third-party API calls to non-EU services (OpenAI, Stripe, Twilio, etc.) - SDK imports for US-based services - Webhook/integration patterns that may involve data export Provides guidance on SCCs, DPAs, and Transfer Impact Assessments. Args: code: The application code content language: Programming language ('python', 'typescript', 'csharp', etc.) file_path: Optional file path for reporting

  • analyze_data_flow

    Analyze code for personal data flow patterns to support ROPA documentation. Maps the data lifecycle: - Collection: Where PII enters the system - Storage: Where PII is persisted - Transmission: Where PII is sent externally - Deletion: Where PII is removed Helps identify GDPR compliance touchpoints for Art. 30 ROPA. Args: code: The application code content language: Programming language ('python', 'typescript', 'csharp', etc.) file_path: Optional file path for reporting

  • analyze_dsr_capabilities

    Analyze code for Data Subject Rights (DSR) implementation capabilities. Detects patterns indicating support for GDPR rights: - Art. 15: Right of access - Art. 16: Right to rectification - Art. 17: Right to erasure - Art. 18: Right to restriction - Art. 20: Right to data portability - Art. 21: Right to object - Art. 22: Automated decision-making safeguards Args: code: The application code content language: Programming language ('python', 'typescript', 'csharp', etc.) file_path: Optional file path for reporting

  • analyze_infrastructure_code

    Analyze Bicep/Terraform/ARM code for GDPR compliance issues. Checks data residency, encryption, access control, logging, retention, and privacy-by-design patterns. Args: code: The IaC code content file_type: 'bicep', 'terraform', or 'arm' file_path: Optional file path for reporting context: Optional additional context

  • assess_controller_processor_role

    Assess whether a service/system acts as data controller, processor, joint controller, or has a mixed role under GDPR. Analyzes the service description against GDPR definitions and EDPB guidance to determine the likely role and associated obligations. Args: service_description: Description of the service, data flows, business relationships, and processing activities

  • assess_dpia_need

    Assess whether a DPIA is required for a described processing activity. Args: processing_description: Free-text description of the data processing

  • assess_retention_policy

    Assess a data-retention policy against GDPR storage-limitation principle (Art. 5(1)(e)) and right to erasure (Art. 17). Args: policy_description: Description of the retention policy

  • check_deletion_requirements

    Check what deletion/anonymization capabilities a system must support per GDPR. Args: system_context: Description of the system and data it holds

  • generate_dpa_checklist

    Generate an Article 28 Data Processing Agreement (DPA) checklist. Provides a comprehensive checklist of mandatory and recommended DPA clauses with Azure-specific considerations. Args: context: Description of the processing relationship and context

  • generate_dpia_template

    Generate a DPIA template pre-filled with guidance for the described processing activity, including risk assessment and mitigation measures. Args: processing_description: Free-text description of the data processing

  • generate_dsr_workflow

    Generate a step-by-step DSR fulfilment workflow with Azure implementation notes. Args: request_type: Type of DSR system_context: Optional description of the system architecture

Show 19 more tools
  • generate_ropa_template

    Generate a Records of Processing Activities (ROPA) template per Art. 30. Args: organization_context: Description of the organization, its role (controller/processor), and main processing activities

  • get_article

    Get the full text and context of a specific GDPR article.

  • get_ast_capabilities

    Get information about AST analysis capabilities. Returns supported languages, analysis categories, detected patterns, and configuration options for the AST-based code analyzer.

  • get_azure_mapping

    Get Azure service recommendations mapped to a specific GDPR article.

  • get_definition

    Get the GDPR definition for a specific term (Art. 4).

  • get_dpia_guidance

    Get detailed DPIA guidance for a specific topic or processing type. Args: topic: Topic area (e.g., 'profiling', 'large-scale monitoring', 'special categories', 'children')

  • get_dsr_guidance

    Get guidance on handling a specific data-subject request. Args: request_type: Type of DSR — 'access', 'rectification', 'erasure', 'restriction', 'portability', 'objection', 'automated_decision'

  • get_dsr_timeline

    Get GDPR-mandated response timelines and extension rules for a DSR type. Args: request_type: Type of DSR

  • get_recital

    Get the text of a specific GDPR recital.

  • get_retention_guidance

    Get GDPR-aligned retention guidance for a specific data category. Args: data_category: Category of data (e.g., 'employee records', 'customer data', 'marketing consent', 'health data', 'financial transactions')

  • get_role_obligations

    Get GDPR obligations specific to a controller/processor role. Returns detailed obligations from relevant GDPR articles with optional Azure implementation guidance. Args: role: 'controller', 'processor', 'joint_controller', or 'sub_processor' include_azure: Include Azure-specific implementation guidance

  • get_role_scenarios

    Get common controller/processor scenarios and role determinations. Returns typical scenarios (SaaS, API services, cloud infrastructure, etc.) with guidance on typical role classification and exceptions. Args: scenario_type: Filter scenarios by type (e.g., 'saas', 'api', 'cloud') or 'all' for all scenarios

  • get_ropa_requirements

    Get the mandatory ROPA fields for a given organizational role. Args: role: 'controller' or 'processor' — determines required fields

  • list_chapter_articles

    List all articles within a specific GDPR chapter.

  • list_definitions

    List all GDPR definitions from Article 4.

  • search_definitions

    Search GDPR definitions by keywords.

  • search_gdpr

    Search across GDPR articles and recitals by keywords.

  • validate_gdpr_config

    Validate IaC configuration against GDPR mandatory requirements BEFORE deploying. Checks for: missing encryption at rest/in transit, public endpoints without justification, insufficient log retention, missing data classification tags, non-EU data residency. Args: code: The IaC code content file_type: 'bicep', 'terraform', or 'arm' strict_mode: If True, fail on any GDPR violation

  • validate_ropa

    Validate a ROPA document against Art. 30 mandatory fields. Args: ropa_content: The ROPA content to validate (text/JSON/markdown)

Signals

Stars
2
Forks
1
Open issues
1
Weekly downloads
49
Last commit
Feb 13, 2026 (8 months ago)
Last release
Feb 11, 2026 (8 months ago)
Last package publish
Feb 11, 2026 (8 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.KevinRabun/GDPRShiftLeftMCP
Version
0.4.0
Auth
No auth
Packages
pypi gdpr-shift-left-mcp
License
MIT
Repository
github.com/KevinRabun/GDPRShiftLeftMCP
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql

More from KevinRabun

Cite this page

GDPR Shift-Left Compliance MCP server. Agent Mart. https://agentmart.dev/connectors/kevinrabun-gdprshiftleftmcp (last updated 2026-10-24)