aadc-audit-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| aadc.audit_allA | Run every AADC compliance audit against a local project and return the consolidated result. Use this whenever the user asks for a full AADC review of a kids app, or before a store submission. |
| aadc.audit_permissionsB | Audit native iOS Info.plist and Android AndroidManifest.xml for any permission outside the AADC-safe allowlist. Standards 8, 10. |
| aadc.audit_sdksA | Audit dependency manifests (pubspec.yaml, package.json, requirements.txt) for analytics / advertising / tracking SDKs or any dependency outside the allowlist. Standards 5, 9, 12, 13. |
| aadc.audit_launchurlA | Audit Dart launchUrl() calls so kid-facing files use the safe-link helper and only declared parent-area paths may open the external browser. Standards 11, 14. |
| aadc.audit_network_isolationC | Audit declared protected paths (microphone, camera, on-device-only data) for any network API import. Standard 8. |
| aadc.audit_defaultsB | Heuristic warn-only scan for default-true on suspicious privacy keys (share / track / profile / etc). Standard 7. |
| aadc.audit_reading_gradeB | Audit user-facing copy for reading grade above the age-appropriate threshold. Standards 4, 11. |
| aadc.audit_placeholdersC | Scan for unreplaced placeholder content (lorem ipsum, TODO copy, dummy text) in shipped user-facing strings. Standards 4, 6. |
| aadc.audit_link_reachabilityC | Warn-only check that external links referenced in content are reachable and not dead. Standards 4, 6. |
| aadc.audit_volume_capB | Verify every audio/video player declares an explicit volume cap. Standards 1, 14. |
| aadc.audit_sentry_hygieneB | Audit Sentry error-reporting initialisation for child-data hygiene (PII scrubbing, no session replay). Standards 7, 9. |
| aadc.audit_hardcoded_urlB | Flag hardcoded URLs outside the CMS that bypass content review. Standards 4, 6. |
| aadc.audit_policy_mentions_sdksA | Warn-only check that the privacy policy names every external-service SDK the app depends on. Standards 4, 9. |
| aadc.list_standardsA | Return the 15 AADC standards with their one-line statutory summaries. Use this as a reference when filling in a conformance statement. |
| aadc.read_standardA | Return the full ICO-published text of one AADC standard by number (1-15). Use this when you need the verbatim wording for a conformance statement or DPIA. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 15 tools
Each audit tool targets a distinct compliance check (e.g., hardcoded URLs, permissions, SDKs), and the two reference tools serve unique non-audit purposes. No two tools overlap in function.
All tools follow the 'aadc.audit_<topic>' pattern in snake_case, with reference tools using 'aadc.list_standards' and 'aadc.read_standard'. The naming is uniform and predictable.
With 15 tools covering 13 distinct audits plus two reference tools, the count is well-scoped for a compliance auditing server. Each tool earns its place without bloat.
The server covers major AADC audit areas (defaults, URLs, permissions, SDKs, etc.) and includes a full scan tool. Reference tools for standards complete the surface. No obvious gaps for its stated purpose.