Skip to main content
Glama
Ansvar-Systems

Romanian Data Protection MCP

Romanian Data Protection MCP

Romanian data protection data for AI compliance tools.

npm version License CI

Query Romanian data protection data -- regulations, decisions, and requirements from ANSPDCP (National Supervisory Authority for Personal Data Processing) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Quick Start

Use Remotely (via Ansvar Gateway, OAuth)

Connect via the Ansvar Gateway with OAuth — your client completes the OAuth flow on first connect. A free tier is available; sign up at ansvar.eu.

Endpoint: https://gateway.ansvar.eu/mcp

Client

How to Connect

Claude.ai

Settings > Connectors > Add Integration > paste URL

Claude Code

claude mcp add ansvar-gateway --transport http https://gateway.ansvar.eu/mcp

Claude Desktop

Add to config (see below)

GitHub Copilot

Add to VS Code settings (see below)

Claude Desktop -- add to claude_desktop_config.json:

{
  "mcpServers": {
    "ansvar-gateway": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

GitHub Copilot -- add to VS Code settings.json:

{
  "github.copilot.chat.mcp.servers": {
    "ansvar-gateway": {
      "type": "http",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Use Locally (npm)

npx @ansvar/romanian-data-protection-mcp

Claude Desktop -- add to claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "romanian-data-protection-mcp": {
      "command": "npx",
      "args": ["-y", "@ansvar/romanian-data-protection-mcp"]
    }
  }
}

Cursor / VS Code:

{
  "mcp.servers": {
    "romanian-data-protection-mcp": {
      "command": "npx",
      "args": ["-y", "@ansvar/romanian-data-protection-mcp"]
    }
  }
}

Related MCP server: Swedish Data Protection MCP

Available Tools (6)

Tool

Description

ro_dp_search_decisions

Full-text search across ANSPDCP decisions (sanctions, warnings, and administrative decisions). Returns matching decis...

ro_dp_get_decision

Get a specific ANSPDCP decision by reference number (e.g.,

ro_dp_search_guidelines

Search ANSPDCP guidance documents: guidelines, opinions, recommendations, and FAQs. Covers GDPR implementation, DPIA ...

ro_dp_get_guideline

Get a specific ANSPDCP guidance document by its database ID.

ro_dp_list_topics

List all covered data protection topics with Romanian and English names. Use topic IDs to filter decisions and guidel...

ro_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Romanian regulatory publications:

  • ANSPDCP (National Supervisory Authority for Personal Data Processing) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by ANSPDCP (National Supervisory Authority for Personal Data Processing). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/romanian-data-protection-mcp
cd romanian-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

This server is part of Ansvar's MCP fleet -- 276 MCP servers covering law, regulation, and compliance across 119 jurisdictions.

Law MCPs

Full national legislation for 108 countries. Example: @ansvar/swedish-law-mcp -- 2,415 Swedish statutes with EU cross-references.

Sector Regulator MCPs

National regulatory authority data for 29 EU/EFTA countries across financial regulation, data protection, cybersecurity, and competition. This MCP is one of 116 sector regulator servers.

Domain MCPs

Specialized compliance domains: EU Regulations, Security Frameworks, Automotive Cybersecurity, OT/ICS Security, Sanctions, and more.

Browse the full fleet at ansvar.eu (access via the Ansvar Gateway, OAuth).


Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
ro_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. 'Return metadata' clearly signals a read-only operation and enumerates the response categories, but it does not explicitly state that it is non-mutating or describe response structure beyond the listed fields. For a simple metadata endpoint this is adequate, though not fully explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler; the purpose and the response contents are front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no params, no output schema). The description lists the four metadata categories, telling an agent what to expect, though it omits the exact response shape (e.g., JSON object). For an 'about' tool this is nearly complete, but specifying the response format would close a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters and an empty object schema, so the baseline is 4. The description lists the metadata categories that will be returned, which is all that is needed; there are no parameter semantics to clarify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return'), a resource ('metadata about this MCP server'), and enumerates the contained fields (version, data source, coverage, tool list). This clearly distinguishes it from the sibling search/get/list tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the use case explicit: retrieve server-level metadata when that information is needed. It does not explicitly contrast with sibling tools or state when not to use it, but the distinction is inferable from the sibling names and the tool's singular purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ro_dp_get_decisionA

Get a specific ANSPDCP decision by reference number (e.g., 'ANSPDCP-2019-001', 'ANSPDCP-2022-015').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesANSPDCP decision reference (e.g., 'ANSPDCP-2019-001', 'ANSPDCP-2022-015')

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It transparently indicates a read-style retrieval operation and scopes it to exact reference lookup. It does not discuss not-found behavior or response shape, but for a simple single-parameter getter this is reasonably transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly worded sentence that starts with the action and resource, then immediately gives the required identifier format with examples. Every element earns its place and there is no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter retrieval tool with no nested objects and no output schema, the description is complete enough for an agent to select and use the tool correctly. It names the exact input needed and provides realistic reference formats. No additional context is necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the description itself mirrors the schema's parameter documentation. It adds example values, but those examples already appear in the schema description. The description does not add significant semantic value beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Get'), a specific resource ('a specific ANSPDCP decision'), and the identifying mechanism ('by reference number'). It also gives concrete examples. This distinguishes it from sibling search tools like ro_dp_search_decisions, which is about finding decisions rather than retrieving a known one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Get a specific ... by reference number' clearly conveys that this tool is for when a known decision reference is available. It implicitly contrasts with search, but it does not explicitly say 'use ro_dp_search_decisions when you don't have a reference,' so it stops short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ro_dp_get_guidelineA

Get a specific ANSPDCP guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from ro_dp_search_guidelines results)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description and tool name convey a read operation, and specifying the target resource helps. However, with no annotations and no output schema, the description does not disclose what the response contains (full text, metadata, etc.) or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. Every word contributes to understanding the tool's purpose and operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter getter, this is nearly complete: it names the resource, the lookup key, and the source of that key. The only notable gap is not clarifying whether the returned value is the full document text or just metadata, especially given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter is already documented with its type and provenance. The tool description adds no parameter-level detail beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Get), resource (ANSPDCP guidance document), and selection mechanism (database ID). This clearly distinguishes it from sibling tools like ro_dp_search_guidelines (search vs. retrieval) and ro_dp_get_decision (guideline vs. decision).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The schema's parameter description identifies the ID as coming from ro_dp_search_guidelines results, implying this tool is used after searching. Context is clear, though there are no explicit exclusions or comparison to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ro_dp_list_topicsA

List all covered data protection topics with Romanian and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It discloses output scope (all topics, Romanian/English names) and the relevance of IDs, but does not describe response structure, format, or limits. Acceptable for a simple non-destructive listing operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no redundancy. The action is front-loaded, and the downstream usage is stated in the second sentence. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description still tells an agent what the tool returns (topics in two languages) and why to call it. It does not spell out the exact item schema, but that is not essential for correct selection and invocation here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so schema coverage is complete by default. The description adds useful context by indicating that topic IDs are the key output used downstream, which is valuable for correct use.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'List' and resource 'all covered data protection topics', and adds detail about Romanian and English names. This clearly differentiates it from sibling decision/guideline search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Second sentence gives a concrete use case: obtaining topic IDs to filter decisions and guidelines. It doesn't explicitly name alternative tools, but the context clearly marks it as a lookup/reference tool for the other operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ro_dp_search_decisionsA

Full-text search across ANSPDCP decisions (sanctions, warnings, and administrative decisions). Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Romanian or English (e.g., 'UniCredit date personale', 'videomonitorizare', 'consimtamant')
topicNoFilter by topic ID (e.g., 'consent', 'cookies', 'transfers'). Optional.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral disclosure burden. It communicates that the operation is a read-only search and specifies what is returned: reference, entity name, fine amount, and GDPR articles cited. It does not mention pagination, result limits beyond the schema's default, or query matching nuances, but these are less critical for a search operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: the first states the action and scope, the second states the return content. Every sentence adds information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description adequately compensates by naming the key fields of matching decisions. With four parameters, a fully documented schema, and no output schema, the description covers the essential context, though explicit mention of the 'opinion' type and pagination could improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters including examples for query and defaults for limit. The description adds little parameter-specific meaning, but this is acceptable because the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific operation, 'Full-text search,' and a specific resource, 'ANSPDCP decisions,' with concrete examples of included content. It also distinguishes this tool from siblings like ro_dp_search_guidelines by narrowing scope to decisions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies this tool is for free-text searching across decisions, but it does not explicitly state when to prefer it over ro_dp_get_decision or ro_dp_search_guidelines. There is no 'when not to use' guidance or named alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ro_dp_search_guidelinesB

Search ANSPDCP guidance documents: guidelines, opinions, recommendations, and FAQs. Covers GDPR implementation, DPIA methodology, cookies, videomonitorizare (CCTV), and more.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Romanian or English (e.g., 'videomonitorizare', 'DPIA', 'cookies consimtamant')
topicNoFilter by topic ID (e.g., 'dpia', 'cookies', 'cctv'). Optional.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the topics covered (GDPR, DPIA, cookies, CCTV) but does not disclose return format, result contents, pagination/limit behavior, or whether the search is read-only. The absence of this context for a search tool with no output schema is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The core function is front-loaded ('Search ANSPDCP guidance documents'), and the second sentence adds valuable scope details without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool, the description provides adequate scope and topic coverage. However, it omits guidance on sibling differentiation and return behavior, and since there are no annotations or output schema, those omissions leave the agent with meaningful uncertainty.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds useful topic context (e.g., 'videomonitorizare (CCTV)') that aligns with query and topic parameters, but it does not go substantially beyond what the parameter descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Search') and identifies a clear resource ('ANSPDCP guidance documents'), listing the document types included (guidelines, opinions, recommendations, FAQs). It is clear and actionable, though it does not explicitly differentiate from the sibling tool ro_dp_search_decisions beyond the implicit 'guidance' vs. 'decisions' distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool searches but gives no explicit guidance about when to use it instead of a sibling like ro_dp_search_decisions. It does not mention alternatives or exclusions, leaving the agent to infer routing from tool names alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedro_dp_about
    • First observedro_dp_get_decision
    • First observedro_dp_get_guideline
    • First observedro_dp_list_topics
    • First observedro_dp_search_decisions
    • First observedro_dp_search_guidelines

TDQS

A4/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct purpose: searching decisions versus searching guidelines, retrieving a specific decision versus retrieving a specific guideline, listing topics, and returning server metadata. There is no meaningful overlap or ambiguity between tool boundaries.

Naming Consistency4/5

All tools share the ro_dp_ prefix and most follow a clear verb_noun pattern such as search_decisions, get_decision, search_guidelines, and get_guideline. The only minor deviation is ro_dp_about, which does not follow the verb_noun pattern.

Tool Count5/5

Six tools is a well-scoped set for a focused read-only data protection research server. Each tool serves a clear purpose without unnecessary redundancy or overwhelming the agent.

Completeness5/5

The server provides both search and retrieval for its two core content types (decisions and guidelines), plus topic listing and metadata. For a read-only research domain, this covers the full expected workflow with no dead ends.

Maintenance

ActivityNo data
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers