Skip to main content
Glama
Ansvar-Systems

Swedish Data Protection MCP

Swedish Data Protection MCP

The Swedish data-protection corpus is now served through the Ansvar Gateway. Connect your AI assistant (Claude, Copilot, Cursor, custom MCP client) to https://gateway.ansvar.eu/mcp — one OAuth connection, free tier available, covering this corpus plus EU regulations, national law across dozens of audited jurisdictions (Europe + the US), and CVE/security intelligence, every result with a verbatim source citation. Start at https://ansvar.eu/docs/quickstart

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth signup flow (setup details: ansvar.eu/docs/quickstart). After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Swedish data protection data for AI compliance tools.

License CI

Query Swedish data protection data -- regulations, decisions, and requirements from IMY (Swedish Authority for Privacy Protection) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: Swiss Data Protection MCP

Available Tools (6)

Tool

Description

se_dp_search_decisions

Full-text search across IMY decisions (tillsynsbeslut, sanctions, ingripanden). Returns matching decisions with refer...

se_dp_get_decision

Get a specific IMY decision by reference number (e.g.,

se_dp_search_guidelines

Search IMY guidance documents: vägledningar, riktlinjer, and ställningstaganden. Covers GDPR implementation, DPIA met...

se_dp_get_guideline

Get a specific IMY guidance document by its database ID.

se_dp_list_topics

List all covered data protection topics with Swedish and English names. Use topic IDs to filter decisions and guideli...

se_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Swedish regulatory publications:

  • IMY (Swedish Authority for Privacy Protection) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by IMY (Swedish Authority for Privacy Protection). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/swedish-data-protection-mcp
cd swedish-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet coverage at ansvar.eu/coverage.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
se_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It clearly indicates a read operation returning metadata with no side effects. However, it does not specify response format or size, which would add further transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the purpose ('Return metadata') and lists key contents. Every word is earned with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with zero parameters and a simple purpose, the description adequately covers what the agent needs to know. It mentions the return contents, though adding that it is a lightweight call or the response is typically small would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the baseline is 4. The description adds meaning by listing what is returned, which goes beyond the empty schema. No parameter documentation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and clearly states the tool provides metadata about the MCP server, listing specific items (version, data source, coverage, tool list). This distinguishes it from sibling tools that focus on decisions, guidelines, or topics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving server-level information, but does not explicitly state when to use this tool versus alternatives, such as 'Use this to get an overview before making queries.' No exclusions or conditions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_dp_get_decisionA

Get a specific IMY decision by reference number (e.g., 'DI-2020-11332', 'IMY-2022-6524').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesIMY decision reference (e.g., 'DI-2020-11332', 'IMY-2022-6524')

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. However, it does not disclose any behavioral traits such as whether the operation is read-only, requires authentication, or has any side effects. The description only states what the tool does, not how it behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the action and resource. No unnecessary words; every part contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description is sufficient for an agent to understand its purpose and usage. It could be enhanced by noting what the response contains, but that's optional.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters with a description. The tool description adds concrete examples of reference numbers, which helps the agent understand the expected format. This adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves a specific IMY decision by reference number, with examples. It distinguishes itself from sibling tools like se_dp_search_decisions by focusing on a single known decision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use: when you have a specific reference number. It does not explicitly state when not to use, but the mention of 'by reference number' guides the agent to only use this tool if a reference is available, otherwise search.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_dp_get_guidelineC

Get a specific IMY guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from se_dp_search_guidelines results)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It only says 'get a specific...' without disclosing error behavior, return structure, or any side effects. Minimal behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise, one sentence. No wasted content, though it may be too brief to fully inform. Structured well for a simple getter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple retrieval tool. Lacks details on output format or error handling, but given no output schema and one parameter, it covers the essential purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear parameter description. The tool description adds no extra meaning beyond what the schema provides, so baseline score is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a specific IMY guidance document by database ID. It differentiates from the search sibling, though does not explicitly contrast with get_decision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over alternatives. The parameter description hints the ID comes from se_dp_search_guidelines, but the description itself lacks context on prerequisites or use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_dp_list_topicsA

List all covered data protection topics with Swedish and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the transparency burden. It accurately describes a read-only operation (list all) without side effects, making behavior transparent for a simple zero-parameter tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the core action and add a useful usage hint. Every sentence adds value with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema, and simple behavior, the description is complete. It explains what the tool returns (bilingual topic names) and how to use the results with sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters (0 params, 100% schema coverage). The description does not need to add parameter details, and the baseline for zero parameters is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'all covered data protection topics', with specific output of 'Swedish and English names'. This distinguishes the tool from siblings which deal with decisions and guidelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence explicitly instructs to use topic IDs to filter decisions and guidelines, providing clear context of when to invoke this tool. However, it does not explicitly state when not to use it or list alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_dp_search_decisionsA

Full-text search across IMY decisions (tillsynsbeslut, sanctions, ingripanden). Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Swedish (e.g., 'samtycke cookies', 'kamerabevakning', 'Google')
topicNoFilter by topic ID (e.g., 'samtycke', 'cookies', 'tredjelandsoverfoering'). Optional.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states it performs a 'full-text search' and returns specific fields, which implies a read operation. However, it does not disclose pagination behavior, rate limits, error handling, or the effect of missing parameters. The description adds moderate transparency but misses key details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, front-loading the action and listing key return fields. It efficiently communicates the core functionality without redundancy. A slightly more structured format (e.g., bullet points) could improve scannability, but current form is adequate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description briefly mentions return fields but does not explain the result structure, error handling, or default behaviors (e.g., limit default of 20 is only in schema). For a search tool, it is moderately complete but lacks details on pagination and filtering of empty queries.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so the baseline is 3. The description adds context about the query language (Swedish) and mentions returned fields, but does not provide additional semantics for the 'type' or 'topic' parameters beyond the schema. The added value is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Full-text search across IMY decisions' and lists the returned fields (reference, entity name, fine amount, GDPR articles). This clearly identifies the tool's purpose and distinguishes it from sibling tools like se_dp_get_decision (single decision retrieval) and se_dp_search_guidelines (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates use for searching decisions but does not provide guidance on when to use this tool versus alternatives like se_dp_get_decision or se_dp_search_guidelines. No exclusion criteria or prerequisites are mentioned. The context with sibling tool names implies differentiation, but the description itself lacks explicit usage instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_dp_search_guidelinesA

Search IMY guidance documents: vägledningar, riktlinjer, and ställningstaganden. Covers GDPR implementation, DPIA methodology, cookie consent, kamerabevakning, and more.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Swedish (e.g., 'kamerabevakning', 'konsekvensbedömning', 'cookies')
topicNoFilter by topic ID (e.g., 'konsekvensbedömning', 'cookies', 'tredjelandsoverfoering'). Optional.

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description alone must convey behavioral traits. It mentions document types and topics but lacks details on read-only nature, authorization, rate limits, error handling, or result behavior (e.g., pagination). This leaves significant gaps for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence using a colon to list document types and topics. It is front-loaded with the core action ('Search IMY guidance documents') and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema and annotations, the description covers the tool's subject but omits key execution details like result format, pagination, required authentication, or how to use filters effectively. It is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 4 parameters. The description adds examples of search topics (e.g., 'kamerabevakning', 'cookies') and guidance types, which provides context beyond the schema but does not substantially augment parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches IMY guidance documents (vägledningar, riktlinjer, ställningstaganden) covering GDPR implementation, DPIA methodology, etc. It distinguishes this from sibling tools like se_dp_search_decisions (legal decisions) and se_dp_get_guideline (single document retrieval).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching guidance documents but does not provide explicit guidance on when to choose this tool over alternatives. No exclusions or context for when-not-to-use is given, though sibling tool names offer some implicit differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedse_dp_about
    • First observedse_dp_get_decision
    • First observedse_dp_get_guideline
    • First observedse_dp_list_topics
    • First observedse_dp_search_decisions
    • First observedse_dp_search_guidelines

TDQS

A3.9/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clear, distinct purpose: search vs retrieval for decisions and guidelines, topic listing, and server metadata. There is no overlap or ambiguity.

Naming Consistency5/5

All tools follow a consistent `se_dp_verb_noun` pattern in snake_case, with 'about' being the only slight outlier but still fitting the noun pattern. Highly predictable.

Tool Count5/5

Six tools is well-scoped for a specialized legal database covering search, retrieval, topic metadata, and server info. Each tool earns its place.

Completeness5/5

Covers all core operations for a read-only legal resource: full-text search over decisions and guidelines, specific retrieval by ID, topic listing, and server metadata. No obvious gaps.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers