Spurvik

Self-assessment of an AI system under the EU AI Act from a few answers: prohibited (Article 5), high-risk (Annex III), Article 50 transparency only, minimal risk, or outside the EU. Returns the duties with their dates and the Spurvik setup steps. Not legal advice and not a decision under Article 6.

Explain the fields of an HMAC provenance receipt JSON. If signingSecret is passed, or SPURVIK_SIGNING_SECRET is set, check the HMAC locally with verifyProvenanceSignature, which checks that the record's signed fields still match the HMAC-SHA-256 signature. It does not show that a notice was shown, that output is marked, or that your system meets the Act. The signing secret is not logged. Omit the secret to explain the fields without checking.

Heuristic static scan of one directory inside the workspace root for AI client calls that are not passed through withSpurvik, spurvikMiddleware, withSpurvikMastra, withSpurvikModel, withSpurvikModelProvider, withSpurvikLangGraph, or spurvikInterrupt. A StateGraph constructor is reported when the file does not call withSpurvikLangGraph. A bare interrupt() call is reported when the file does not call spurvikInterrupt or resolveLangGraphInterrupts. The scan reads .ts, .tsx, .js, .jsx, .mjs, .cjs, .mts, and .cts files. It does not read .md or .mdc files. Results are file:line. The line number is 1-based and counts every newline, including comments and strings. This is a heuristic, so it can miss a call or report one that is already wrapped. The scan does not change files and does not use the network. Paths that leave the workspace, including '..', are rejected. The scanner skips files named .env or .env.* (any case), including through symlinks and hard links. Over HTTP there is no workspace directory. Pass code (a string, max 128 KB) or files (an array of { path, content }). If neither is passed, this tool explains that, and how to run the local stdio MCP server or /spurvik:check for a directory scan.

Generate a copy-paste EU AI Act Article 50 notice: a badge.js tag or a React snippet, in any of the 24 EU languages, with a preview of the notice text. The language is inferred from a domain-like systemName when locale is omitted.

Explain how to plug your own Article 50(2) marking into marking.text or marking.media. Spurvik does not mark content. withSpurvik and spurvikMiddleware log the call and attach an HMAC receipt. A hook runs only when you supply one. The signed text trailer is an application-level binding you can opt into. It is not, by itself, an Article 50(2) machine-readable mark.

Scan one public HTTPS page for AI chat widgets and AI SDKs and check whether a visible EU AI Act Article 50(1) notice is present. Returns the host, HTTP status, findings, the suggested notice language, a one-line badge.js fix and links to the full report. Heuristic: reads the HTML of one page only. Not legal advice.

Return a setup snippet for openai, anthropic, google-genai, vercel-ai-sdk, mastra, openai-agents, or langgraph. Provider clients are wrapped with withSpurvik. The Vercel AI SDK snippet passes spurvikMiddleware to wrapLanguageModel. The Mastra snippet calls withSpurvikMastra. The OpenAI Agents snippet calls withSpurvikModelProvider. The LangGraph snippet calls withSpurvikLangGraph and spurvikInterrupt. The snippet is built from the installed spurvik exports (spurvik or spurvik-sdk, including spurvik/ai, spurvik/langgraph, spurvik/mastra, and spurvik/openai-agents). The disclosure label is a separate React client snippet that imports spurvik/react. riskTier is a sample value. Set your own classification (as provider or deployer); Spurvik does not classify your use case. The SDK logs the call and attaches an HMAC receipt. It does not mark content. Also accepts react.