Skip to main content
Glama
Ansvar-Systems

Luxembourgish Data Protection MCP

Luxembourgish Data Protection MCP

▶ Try this MCP instantly via Ansvar Gateway

50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway

One endpoint, one OAuth signup, access from any MCP-compatible client.

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Luxembourgish data protection data for AI compliance tools.

License CI

Query Luxembourgish data protection data -- regulations, decisions, and requirements from CNPD (Commission nationale pour la protection des donnees) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: Slovak Data Protection MCP

Available Tools (6)

Tool

Description

lu_dp_search_decisions

Full-text search across CNPD decisions (délibérations, sanctions, mises en demeure). Returns matching decisions with ...

lu_dp_get_decision

Get a specific CNPD decision by reference number (e.g.,

lu_dp_search_guidelines

Search CNPD guidance documents: guides pratiques, recommandations on vidéosurveillance, cookies, sous-traitance, tran...

lu_dp_get_guideline

Get a specific CNPD guidance document by its database ID.

lu_dp_list_topics

List all covered data protection topics with French and English names. Use topic IDs to filter decisions and guidelines.

lu_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Luxembourgish regulatory publications:

  • CNPD (Commission nationale pour la protection des donnees) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by CNPD (Commission nationale pour la protection des donnees). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/luxembourgish-data-protection-mcp
cd luxembourgish-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet at ansvar.eu/gateway.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
lu_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. For a metadata/about tool, the description clearly states what it returns (version, data source, coverage, tool list), which is effectively the behavioral contract for a read-only introspection tool. This is adequate disclosure for an about endpoint that doesn't mutate state or have side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that covers exactly what the tool returns with no wasted words. Front-loaded with the verb 'Return' and immediately enumerates the metadata categories. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a zero-parameter about/metadata tool with no output schema, which makes it low complexity. The description enumerates the four categories of metadata returned (version, data source, coverage, tool list), which is sufficient for an agent to know what information it will get. No additional context about return format is strictly needed for such a simple introspection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is 100% (trivially, since the schema is empty). With no parameters to explain, the description has nothing to add beyond what the schema shows. Baseline 4 applies for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return') with a specific resource ('metadata about this MCP server') and enumerates the exact categories of data returned (version, data source, coverage, tool list). It clearly distinguishes itself from sibling research/retrieval tools (get_guideline, list_topics, search_guidelines) by being about the server itself rather than its domain content.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. However, the purpose is self-evident: an 'about' endpoint is for server metadata, clearly distinct from sibling content-query tools. The usage context is strongly implied by the tool's nature, though no explicit alternatives or exclusions are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lu_dp_get_decisionA

Get a specific CNPD decision by reference number (e.g., 'CNPD-2021-001', 'CNPD-DEC-2023-001').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesCNPD decision reference (e.g., 'CNPD-2021-001', 'CNPD-DEC-2023-001')

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The description implies a read operation (Get) but doesn't state whether this is non-destructive/read-only, whether it has permission requirements, what happens for invalid/malformed reference numbers, or what the response shape is. For a retrieval tool this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with zero wasted words. Example formats are embedded inline for immediate usefulness. No redundant information or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple retrieval tool with a single well-documented parameter and output schema absent. The description sufficiently covers what the tool does and how to identify target decisions. It could note error behavior or return format, but for a basic single-param fetcher, the information provided is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with the single 'reference' parameter well-documented in the schema. The description adds value by providing example formats for the reference parameter beyond what the schema states, giving the agent concrete syntax patterns to use. However, it largely overlaps with schema content, so it doesn't exceed the baseline 3 by much.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (Get), resource (CNPD decision), and specific identifying mechanism (reference number). It also provides concrete example formats ('CNPD-2021-001', 'CNPD-DEC-2023-001') that distinguish it from sibling tools like lu_dp_search_decisions (search vs. direct fetch).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly communicates when to use this tool — when you have a specific reference number and want a particular decision, as opposed to searching for decisions. It does not explicitly state 'use search_decisions for discovery, then this for retrieval', which would earn a 5, but the reference-based targeting is clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lu_dp_get_guidelineB

Get a specific CNPD guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from lu_dp_search_guidelines results)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It doesn't disclose what the returned document contains, whether it's a full text or summary, whether any authentication is needed, or any rate-limit/format considerations. For a retrieval tool with zero annotation coverage, this is a meaningful gap in behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is direct and devoid of filler. Every word adds information — the actor verb, the resource type, the key, and the scoping detail. Zero waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-param, no-output-schema retrieval tool, the description is mostly adequate. The ID provenance hint, the clear verb, and the resource identification cover the essentials. However, without any annotations, additional context about what form the returned guidance takes (full text vs metadata) would materially improve completeness for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single well-described parameter. The description adds the sourcing hint that the ID comes from search_guidelines results, which enriches the schema's basic 'Guideline database ID' text by telling the agent where the ID originates. The 0-param-fix baseline is 4, and the description does provide useful provenance context for the ID value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb+resource ('Get' a 'CNPD guidance document') and specifies the retrieval key ('by its database ID'). It's not identical to siblings — search_guidelines obviously lists rather than fetches a single item — but it doesn't explicitly differentiate from get_decision or other retrieval tools beyond the resource type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage in the context of already having located a document's ID, and the parameter description mentions 'from lu_dp_search_guidelines results'. This creates an implicit workflow connection but doesn't explicitly state when to use this tool vs alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lu_dp_list_topicsA

List all covered data protection topics with French and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The description indicates the tool returns a listing of topics with bilingual names, which addresses the read-only nature implicitly. However, it doesn't disclose potential pagination, ordering, or whether the full list is always returned—though with 0 parameters, it's likely a complete static list. Acceptable but minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences, zero waste. The first states the core purpose and output format, and the second gives a practical hint about downstream usage (filtering by topic IDs). Well-structured and appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a zero-parameter list tool with no output schema, the description is reasonably complete. It explains what is returned (topics with both French and English names) and suggests a downstream use case. There's no output schema, so the description somewhat compensates by noting the bilingual names. Adequate coverage for a simple listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is nothing to document. Per the rubric, 0 params yields a baseline of 4. The description correctly notes the output format (bilingual names), which adds value beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb+resource pattern: 'List all covered data protection topics.' This is specific and unambiguous. While it doesn't explicitly contrast with siblings, the purpose is distinct from search/get operations among siblings, and the mention of bilingual names sharpens clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a clear use case: 'Use topic IDs to filter decisions and guidelines.' This implicitly tells the agent when to call this tool (i.e., likely as a prerequisite before using search/filter functions). However, it doesn't explicitly name alternatives or state when not to use it. The guidance is helpful but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lu_dp_search_decisionsA

Full-text search across CNPD decisions (délibérations, sanctions, mises en demeure). Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in French (e.g., 'Amazon', 'sous-traitant', 'transfert données', 'consentement')
topicNoFilter by topic ID (e.g., 'sous_traitance', 'cookies', 'transferts'). Optional.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. The description usefully states it returns 'matching decisions with reference, entity name, fine amount, and GDPR articles cited,' which is helpful forward-looking context. However, it doesn't disclose pagination/limit behavior, case-sensitivity, relevance ranking, or what a zero-result response looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single well-formed sentence that front-loads the core purpose and adds return value detail efficiently. No wasted words, though it could marginally tighten the parenthetical list of decision types which are partially restated in the type param enum.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with 100% schema coverage and no output schema, the description conveys the core behavior (what is searched, what is returned). It's reasonably complete for a filtered-full-text-search tool, though it lacks explicit guidance on using topic/type filters together or result count handling, which the limit param implies.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 4 parameters and their meaning. The description adds the return-field context (reference, entity name, fine amount, GDPR articles) but doesn't add extra meaning about the parameters themselves beyond the schema, hence the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description has a specific verb+resource ('Full-text search across CNPD decisions') and clearly distinguishes from siblings: it searches decisions (vs lu_dp_get_guideline which retrieves guidelines, lu_dp_search_guidelines which searches guidelines, and lu_dp_get_decision which retrieves a single decision). It enumerates decision sub-types and return fields, giving clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (searching the CNPD decisions corpus) and the French-language requirement is explicit in the query param ('Search query in French'). However, it doesn't explicitly state when NOT to use this vs lu_dp_get_decision, which would be its closest sibling, though the verb split (search vs get) implies the distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lu_dp_search_guidelinesB

Search CNPD guidance documents: guides pratiques, recommandations on vidéosurveillance, cookies, sous-traitance, transferts, and financial sector obligations.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in French (e.g., 'vidéosurveillance', 'sous-traitant', 'analyse impact')
topicNoFilter by topic ID (e.g., 'sous_traitance', 'vidéosurveillance', 'cookies'). Optional.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It doesn't disclose return format, pagination behavior, or whether results are ranked by relevance. It does clarify the query must be in French (a useful operational constraint) and lists topic coverage areas, but doesn't describe what happens for empty/no-match searches. With no annotations, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the primary verb and resource, followed by concrete topic examples. Zero waste. Could arguably earn a 5, but the sentence is slightly dense on examples which could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with well-documented params and no output schema, the description covers the main axes: what it searches, the language requirement, and the topic scope. However, it doesn't clarify the relationship to lu_dp_get_guideline (does search return full docs or IDs for subsequent retrieval?) and lacks any notes about return structure or limits given no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (query, type, limit, topic) are already documented in the schema. The description adds marginal value by explaining query should be in French and giving example values, and implicitly links the topic parameter to the listed domains. Baseline 3 is appropriate since the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Search') with a clear resource ('CNPD guidance documents') and lists concrete example topics (vidéosurveillance, cookies, sous-traitance). It distinguishes from sibling tools by positioning this as the search entry point vs. lu_dp_get_guideline (retrieval) or lu_dp_list_topics (topic enumeration), though it doesn't explicitly name the sibling to differentiate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is for searching guidance documents vs. lu_dp_search_decisions which presumably searches decisions, and mentions French queries explicitly. However, it doesn't state when to use this vs lu_dp_list_topics or lu_dp_get_guideline, nor any exclusions/alternatives. Usage context is inferred rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedlu_dp_about
    • First observedlu_dp_get_decision
    • First observedlu_dp_get_guideline
    • First observedlu_dp_list_topics
    • First observedlu_dp_search_decisions
    • First observedlu_dp_search_guidelines

TDQS

A3.9/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a clearly distinct purpose: getting guidelines vs. decisions, listing topics, searching guidelines vs. decisions, and retrieving server metadata. There is no overlap or ambiguity between search and get operations, and the topic listing tool serves as a distinct discovery mechanism.

Naming Consistency4/5

Tools use a consistent lu_dp_ prefix with get_/list_/search_ verbs followed by resource nouns (guideline, decisions, topics), forming a predictable pattern. Minor deviation: 'about' doesn't follow the verb_noun pattern, breaking the otherwise consistent convention slightly.

Tool Count5/5

Six tools is a well-scoped surface for a domain-specific data protection server. Each tool earns its place, covering discovery (about, list_topics), search (search_guidelines, search_decisions), and retrieval (get_guideline, get_decision) without redundancy.

Completeness4/5

The server covers the core workflows well: discovering topics, searching and retrieving guidelines, and searching and retrieving decisions with metadata like fines and GDPR articles. A minor gap is the lack of a 'get_topic' detail tool or direct lookup of decisions by entity name, but the full-text search covers most needs.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers