io.github.CSOAI-ORG/eu-ai-act-compliance-mcp

Helps teams check EU AI Act requirements and compliance guidance.

Source

Official Registry

Updated

2026-06-13

// securityCaution

Runs locally
Official / curated
Open source
Community-trusted

Summary

The available material is sparse, but the tool is listed in an official registry, open source, and recently maintained, which materially lowers overall risk. The main confirmed capability is local code execution, a normal MCP property that warrants caution; with no required secrets, no declared remote endpoints, and no README details, there are no concrete red flags sufficient for a high-risk rating.

CredentialsLow risk

The material explicitly states that no keys or environment variables are required. No API key, token, or other sensitive credential is requested, so credential exposure and abuse risk appears low based on the available facts.

Network egressLow risk

The material states 'remote endpoint host: none,' and the README provides no indication of external service connections or data upload paths. Based on the current evidence, no explicit network egress behavior is shown.

Code executionCaution

The system flags executes-code, indicating the tool can execute code or processes on the local machine. This is a normal high-privilege MCP capability and merits caution, but by itself is not sufficient to classify the tool as high risk.

Data accessCaution

The documentation does not specify which files or resources it can read or write, leaving the data access scope unclear. Given its ability to execute local code, it may theoretically interact with local data, so least-privilege use is advisable; however, the material does not show any explicit request for excessive access.

Supply chainCaution

Positive signals include an official registry listing, an open-source repository that can be audited, and updates within the last year; these materially reduce supply-chain risk. Points to watch are the missing README, undeclared license, and very low community adoption (0 stars), so auditability exists but maturity signals are limited.

Recommendations

Review the GitHub source code and dependency list before installation, especially for undeclared network calls or sensitive file access.
Run it in an isolated environment or under a restricted user account, and limit its accessible working directories and system privileges.
If real-world behavior shows outbound network access or data access beyond expectations, reassess and raise the risk level.
Prefer waiting for a proper README, license declaration, and clearer functional boundaries before using it in production.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.CSOAI-ORG/eu-ai-act-compliance-mcp" MCP server from askskill:
Run: claude mcp add 'io-github-csoai-org-eu-ai-act-compliance-mcp' -- npx -y eu-ai-act-compliance-mcp