Skip to main content
Glama

Polish Data Protection MCP

▶ Try this MCP instantly via Ansvar Gateway

50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway

One endpoint, one OAuth signup, access from any MCP-compatible client.

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Polish data protection data for AI compliance tools.

License CI

Query Polish data protection data -- regulations, decisions, and requirements from UODO (Personal Data Protection Office) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: io.github.mister-franklin/gdpr-decisions

Available Tools (6)

Tool

Description

pl_dp_search_decisions

Full-text search across UODO decisions (sanctions, administrative decisions, and orders). Returns matching decisions ...

pl_dp_get_decision

Get a specific UODO decision by reference number (e.g.,

pl_dp_search_guidelines

Search UODO guidance documents: guidelines, opinions, recommendations, and FAQs. Covers GDPR implementation, employee...

pl_dp_get_guideline

Get a specific UODO guidance document by its database ID.

pl_dp_list_topics

List all covered data protection topics with Polish and English names. Use topic IDs to filter decisions and guidelines.

pl_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Polish regulatory publications:

  • UODO (Personal Data Protection Office) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by UODO (Personal Data Protection Office). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/polish-data-protection-mcp
cd polish-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet at ansvar.eu/gateway.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
pl_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It clarifies that the tool returns metadata, which implies a read-only operation, but it does not explicitly state that no side effects occur, nor does it describe any special behavior (e.g., caching, authentication). This is sufficient for a simple metadata tool but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the action ('Return metadata') and concisely enumerates the specific metadata fields. No wasteful words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema and no annotations, the description adequately lists the return content (version, data source, coverage, tool list). It does not detail the format or structure, but the context is simple enough that this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty input schema, so the schema coverage is trivially 100%. The description needs to add no parameter semantics, and the baseline of 4 applies since there are no parameters to explain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Return metadata about this MCP server' with a clear list of content (version, data source, coverage, tool list). It uses a specific verb and resource, and clearly distinguishes from sibling tools that search decisions, guidelines, or list topics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by the tool's nature—an 'about' endpoint—but there is no explicit statement of when to use it or how it differs from siblings. No exclusions or alternatives are mentioned, so it falls between clear context and merely implied usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pl_dp_get_decisionA

Get a specific UODO decision by reference number (e.g., 'ZSPR.421.1.2019', 'DKN.5112.1.2019').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesUODO decision reference (e.g., 'ZSPR.421.1.2019', 'DKN.5112.1.2019')

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the reference format but not error behavior, return structure, or any other operational details. For a simple read operation, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, focused sentence with examples. No wasted words; it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one parameter and no output schema. The description gives all necessary information about what the parameter is and its format. It doesn't explain the return value, but the rules state that is unnecessary without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and both the tool description and schema provide the same examples. The description adds no additional meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get'), the resource ('UODO decision'), and the identifier ('by reference number') with concrete examples. This distinguishes it from the sibling search tool, which is for querying.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: when you already have a specific reference number, use this tool. It doesn't explicitly contrast with search_decisions, but the 'specific' wording and reference examples provide clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pl_dp_get_guidelineA

Get a specific UODO guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from pl_dp_search_guidelines results)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly indicates a read operation ('Get'), but it does not disclose what the returned document contains, error behavior if the ID is not found, or any other side effects. For a simple get-by-ID tool, this is minimally adequate but lacks behavioral detail that could help the agent anticipate outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence with no wasted words. It immediately conveys the tool's purpose and parameter context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description covers the essential facts: what it does and how to identify the target document. The ID provenance is provided in the schema. The only minor gap is the lack of description of the return value, but for a get-by-ID tool, this is often self-explanatory from the name.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage for the single parameter 'id', including a description that it is the 'Guideline database ID (from pl_dp_search_guidelines results)'. The description itself adds no additional parameter meaning beyond this, so the baseline of 3 for high schema coverage applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states exactly what the tool does: 'Get a specific UODO guidance document by its database ID.' The verb 'Get' and the resource 'UODO guidance document' are specific, and the access method (by database ID) clearly distinguishes it from sibling tools like pl_dp_search_guidelines, which would be used for searching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that you use this tool when you have a database ID for a guidance document, and the input schema reinforces this by stating the id comes from pl_dp_search_guidelines results. This gives clear context that this tool is for retrieval after a search, not for searching itself. It lacks explicit exclusions, but the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pl_dp_list_topicsA

List all covered data protection topics with Polish and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing behavior. It implies a read-only operation ('List') and that results include IDs and names, but it does not explicitly state read-only nature, output format, or any limitations. Adequate for a simple list operation but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exactly two sentences: the first states the purpose, the second provides usage guidance. Every word earns its place, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema, and a straightforward listing operation, the description sufficiently covers what is returned (topics with Polish and English names) and how to apply the results. It could explicitly state it is read-only and requires no arguments, but those are already inferable from the schema and simple nature.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero parameters, so the baseline is 4. The description adds meaning by explaining how topic IDs (inherent to the output) are used for filtering, which gives semantic context beyond the empty input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List') and the resource ('all covered data protection topics'), with specific detail that names are provided in Polish and English. This distinguishes it from sibling tools that focus on decisions and guidelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The sentence 'Use topic IDs to filter decisions and guidelines' provides clear context for when this tool is valuable, implying it is a prerequisite for filtering other resources. It does not explicitly list alternatives or exclusions, but the usage context is evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pl_dp_search_decisionsA

Full-text search across UODO decisions (sanctions, administrative decisions, and orders). Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Polish or English (e.g., 'Morele dane osobowe', 'przetwarzanie danych', 'consent')
topicNoFilter by topic ID (e.g., 'consent', 'cookies', 'transfers'). Optional.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states that it returns matching decisions with reference, entity name, fine amount, and GDPR articles cited, which is useful. However, it does not explicitly confirm read-only behavior, mention any limitations (e.g., result sorting, pagination beyond the limit parameter), or disclose any other behavioral quirks. The description provides some transparency but not comprehensive detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded, information-dense sentence. It states the core purpose first, then lists the return fields. Every word adds value; there is no redundancy or filler. This is an exemplary level of conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 4 parameters, no annotations, and no output schema. The description covers the core functionality and return fields but does not explain how this tool relates to siblings (e.g., when to use get_decision vs this search), nor does it mention any nuances like pagination or the meaning of type vs topic. The schema covers parameters, but the description lacks guidance on tool selection and edge cases, leaving some gaps for a complete contextual picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so the baseline is 3. The description adds context that returns include fine amount and GDPR articles, which implies relevance of the query and topic parameters, but it does not add additional meaning beyond the schema for individual parameters. It offers minimal extra semantic value over the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (full-text search) and a specific resource (UODO decisions), listing the decision subtypes (sanctions, administrative decisions, orders). It distinguishes itself from sibling tools like pl_dp_search_guidelines and pl_dp_get_decision by focusing on searching decisions rather than guidelines or retrieving a single decision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: use this tool to search across decisions. However, it does not explicitly contrast with alternatives such as pl_dp_search_guidelines or pl_dp_get_decision, nor does it state when not to use it. The context is clear but exclusions and alternative recommendations are absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pl_dp_search_guidelinesA

Search UODO guidance documents: guidelines, opinions, recommendations, and FAQs. Covers GDPR implementation, employee monitoring, cookies, DPIA methodology, and more.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Polish or English (e.g., 'monitoring pracowników', 'DPIA', 'cookies')
topicNoFilter by topic ID (e.g., 'dpia', 'cookies', 'employee_monitoring'). Optional.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only describes the search scope and content coverage, without disclosing read-only behavior, rate limits, pagination, or any side effects. The term 'Search' implies safety but is not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action and resource, then adds relevant context about document types and topics. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity, fully documented schema, and clear scope, the description is sufficient. It does not need to detail return values since the schema covers limit defaults, and the description provides enough context for the agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has full descriptions for all four parameters, including examples and an enum for type. The description adds no additional parameter-level semantics beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search UODO guidance documents' and enumerates the types (guidelines, opinions, recommendations, FAQs) and topics covered, distinguishing it from sibling tools like search_decisions or get_guideline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching guidance documents, but does not explicitly mention when to use alternatives such as pl_dp_search_decisions. No exclusions or prerequisites are stated, leaving comparison to siblings implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedpl_dp_about
    • First observedpl_dp_get_decision
    • First observedpl_dp_get_guideline
    • First observedpl_dp_list_topics
    • First observedpl_dp_search_decisions
    • First observedpl_dp_search_guidelines

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: search decisions, get a specific decision, search guidelines, get a specific guideline, list topics, and server metadata. There is no overlap or ambiguity among them.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern (search_decisions, get_decision, search_guidelines, get_guideline, list_topics). The 'about' tool is a minor deviation but not disruptive.

Tool Count5/5

With 6 tools, the server is well-scoped for its purpose: covering search and retrieval of decisions and guidelines, plus topic filtering and metadata. Each tool earns its place.

Completeness5/5

The tool surface fully covers the intended domain: search and retrieve both decisions and guidelines, with topic support for filtering. Since this is a read-only public data source, no CRUD operations are needed.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI-powered legal research and analysis of Polish legal acts from the Sejm API. Provides comprehensive search, document retrieval, metadata analysis, and content access for legal documents from Dziennik Ustaw and Monitor Polski.
    13
    21
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Provides AI-powered access to the largest EU GDPR enforcement decisions database, enabling semantic search, GDPR article lookup, and enforcement statistics across all EU/EEA Data Protection Authorities.
    4
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables searching and analyzing decisions from the Polish Data Protection Authority (UODO) directly within AI clients, allowing full-text search, filtering, and retrieval of GDPR enforcement decisions.
    3
    19
    1
    Apache 2.0