Skip to main content
Glama
Ansvar-Systems

estonian-data-protection-mcp

Estonian Data Protection MCP

▶ Try this MCP instantly via Ansvar Gateway

50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway

One endpoint, one OAuth signup, access from any MCP-compatible client.

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Estonian data protection data for AI compliance tools.

License CI

Query Estonian data protection data -- regulations, decisions, and requirements from AKI (Estonian Data Protection Inspectorate) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: Portuguese Cybersecurity MCP

Available Tools (6)

Tool

Description

ee_dp_search_decisions

Full-text search across AKI (Andmekaitse Inspektsioon) decisions and sanctions. Returns matching decisions with refer...

ee_dp_get_decision

Get a specific AKI decision by reference number.

ee_dp_search_guidelines

Search AKI guidance documents: recommendations, guidelines, and FAQs on GDPR implementation in Estonia.

ee_dp_get_guideline

Get a specific AKI guidance document by its database ID.

ee_dp_list_topics

List all covered data protection topics with Estonian and English names. Use topic IDs to filter decisions and guidel...

ee_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Estonian regulatory publications:

  • AKI (Estonian Data Protection Inspectorate) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by AKI (Estonian Data Protection Inspectorate). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/estonian-data-protection-mcp
cd estonian-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet at ansvar.eu/gateway.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
ee_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses exactly what the tool returns (version, data source, coverage, tool list) and clearly implies a read-only, side-effect-free operation. It does not discuss potential latency or failure modes, but for a simple metadata endpoint this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every word adds value, listing exactly what will be returned. It is appropriately sized for a tool with no parameters and no complex behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema, no annotations), the description is fully complete. It states the exact purpose and the specific metadata fields returned, leaving no ambiguity about the tool's function or how to interpret its output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100% (empty object). The description does not need to compensate for undefined parameters. The baseline for 0 params is 4, and the description adds clarity about the output despite no parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and a clear resource ('metadata about this MCP server'), explicitly listing the content (version, data source, coverage, tool list). This clearly distinguishes it from the sibling data-search tools: it is about the server itself, not decisions or guidelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used to get server-level metadata, but it does not explicitly state when to use it versus alternatives. For an 'about' tool, the use case is self-evident, but there is no explicit guidance or exclusion like 'use when you need server info'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_dp_get_decisionA

Get a specific AKI decision by reference number.

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesAKI decision reference (e.g., 'AKI-2022-001')

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It conveys a read-only 'get' action, but does not mention return format, error handling (e.g., invalid reference), or any other behavioral nuances. It's minimally adequate for a simple getter but lacks enrichment.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence (10 words) that gets straight to the point. There is no fluff, and the key information (action, resource, identifier) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only one required parameter, no output schema, and no annotations. Given its low complexity, the description sufficiently covers the core purpose and invocation. It doesn't describe the return value explicitly, but 'get a decision' reasonably implies the decision object is returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with a clear description of the 'reference' parameter, including an example. The tool description's phrase 'by reference number' adds no new semantic information beyond what the schema lists, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (Get), a resource (AKI decision), and the identifying method (by reference number). This clearly distinguishes it from sibling tools like ee_dp_search_decisions and ee_dp_get_guideline, which operate on different resources or use different access patterns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: when you have a specific reference number and need a single decision. It doesn't explicitly exclude alternatives or mention when not to use it, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_dp_get_guidelineA

Get a specific AKI guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from ee_dp_search_guidelines results)

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It indicates a retrieval operation ('Get') but does not disclose the return format, whether it returns the full document or metadata, or error behavior for invalid IDs. It adds minimal context beyond the action itself.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no unnecessary words. It accurately and efficiently communicates the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and no output schema, so the description should at least indicate what the response will contain. 'Guidance document' is vague about structure or content. However, for a straightforward get-by-ID tool, it provides enough to select the tool, though not enough to predict the full response shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters, with the 'id' field described as 'Guideline database ID (from ee_dp_search_guidelines results)'. This gives clear provenance for the parameter. The tool description adds no further detail, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get a specific AKI guidance document by its database ID.' It uses a specific verb ('Get'), identifies the resource ('AKI guidance document'), and specifies the key parameter ('database ID'). This distinguishes it from sibling tools like ee_dp_search_guidelines, which is for searching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by specifying 'by its database ID' and the parameter description clarifies that the ID comes from ee_dp_search_guidelines results. This effectively tells the agent when to use this tool (after a search) without explicitly naming alternatives. It's clear but doesn't state exclusions or conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_dp_list_topicsA

List all covered data protection topics with Estonian and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the transparency burden. It implies a read-only operation via 'list' and describes the output (Estonian and English names). It doesn't disclose output format or pagination, but for a zero-parameter listing tool, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the main purpose, followed by a practical usage tip. No redundant information or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-parameter list tool, the description is complete. It states what is listed, the language variant, and the practical use case. Given the low complexity and lack of output schema, no additional detail is necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema, so there are no parameter semantics to clarify. The description adds value by relating the output to topic IDs for use in other tools, which helps the agent understand the purpose of the returned data.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all covered data protection topics with Estonian and English names, using a specific verb ('list') and resource. The mention of topic IDs for filtering decisions and guidelines distinguishes it from sibling search/get tools for decisions and guidelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when to use the tool: to obtain topic IDs for filtering decisions and guidelines. It doesn't explicitly state alternatives or exclusion criteria, but the context is clear and useful for selecting this tool over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_dp_search_decisionsA

Full-text search across AKI (Andmekaitse Inspektsioon) decisions and sanctions. Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query (e.g., 'küpsised', 'töötajate jälgimine', 'andmeleke')
topicNoFilter by topic ID (e.g., 'consent', 'cookies', 'data_breach'). Optional.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry full weight. It discloses the scope (AKI decisions/sanctions) and returns key fields, but it does not mention behavior such as pagination, sorting, default limits (though 'limit' is in schema), or potential absence of results. The 'full-text' aspect is useful but limited.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two short sentences, front-loading the core purpose and then listing return fields. Every sentence adds value, and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description reasonably lists the key return fields and clarifies scope. It does not explain error handling or filter interactions, but for a search tool of moderate complexity, it is mostly self-sufficient. Sibling tool names further contextualize its role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters with clear descriptions and examples. The tool description adds no additional parameter semantics beyond what is in the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs 'Full-text search across AKI decisions and sanctions' and lists the returned fields (reference, entity name, fine amount, GDPR articles cited). This distinguishes it from siblings like ee_dp_get_decision (which retrieves a single decision) by focusing on search rather than retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching decisions and sanctions, and the return fields make it clear this is for finding matches. However, it does not explicitly state when to prefer this over ee_dp_get_decision or ee_dp_search_guidelines, nor does it mention exclusions or prerequisites, leaving a small gap in guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_dp_search_guidelinesA

Search AKI guidance documents: recommendations, guidelines, and FAQs on GDPR implementation in Estonia.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query (e.g., 'DPIA', 'küpsised', 'andmesubjekti õigused')
topicNoFilter by topic ID. Optional.

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior. The verb 'Search' implies a read-only operation, and the description states the resource scope. However, it does not mention return format, pagination, filtering behavior, or any side effects. This is adequate but minimal for a simple search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that immediately states the action and resource. It contains no fluff and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does not hint at what the results look like (e.g., list of documents, metadata). The schema fully documents parameters, and the description gives overall context, but for a tool with no output schema, a bit more detail about the result shape or limit behavior would make it more complete. It is minimally viable but lacks that extra context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by listing the document categories (recommendations, guidelines, FAQs) which map to the 'type' enum, and by providing geographic/policy context (Estonia GDPR) that helps interpret query examples. This goes slightly beyond the raw schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Search') and resource ('AKI guidance documents'), and further clarifies the document types ('recommendations, guidelines, and FAQs'). This clearly distinguishes the tool from siblings like ee_dp_search_decisions and ee_dp_get_guideline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear context for when to use this tool (searching guidance documents on GDPR in Estonia) but does not explicitly mention when not to use it or list alternative tools. However, the context is unambiguous enough for an agent to select it over the decision-search sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedee_dp_about
    • First observedee_dp_get_decision
    • First observedee_dp_get_guideline
    • First observedee_dp_list_topics
    • First observedee_dp_search_decisions
    • First observedee_dp_search_guidelines

TDQS

A4.2/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct resource/action: decisions vs guidelines vs topics vs server metadata. Search and get are clearly separated for both content types, leaving no ambiguity.

Naming Consistency4/5

The ee_dp_ prefix and verb_noun pattern are consistent for five tools, but 'about' is a minor deviation as an informational endpoint rather than a verb_noun.

Tool Count5/5

6 tools is an appropriate scope for a read-only data protection repository, covering search and retrieval for two content types plus navigation and metadata.

Completeness5/5

The surface fully covers the domain: search and get for decisions and guidelines, topic listing for filtering, and server info. No obvious missing operations for the read-only purpose.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers