pdpa-audit-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PDPA_AUDIT_ALLOWED_ROOTS | No | Semicolon-delimited (Windows) or colon-delimited (Linux/macOS) list of paths allowed for project file inspection. Defaults to the current directory. | |
| PDPA_AUDIT_ALLOW_PRIVATE | No | Set to true only when auditing local development servers (http://localhost:3000, 127.0.0.1). Defaults to false. | false |
| PDPA_AUDIT_TIMEOUT_SECONDS | No | Per-request HTTP network timeout in seconds. Defaults to 10.0. | 10.0 |
| PDPA_AUDIT_FETCH_DEADLINE_SECONDS | No | Total deadline for full page fetch and redirect chains. Defaults to 20.0. | 20.0 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": true
} |
| resources | {
"subscribe": false,
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_privacy_policyC | Audit website privacy policy for technical transparency and data subject rights. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| detect_cookie_consentB | Detect cookie consent banners, CMP markup, and tracking scripts in static HTML. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| find_personal_data_formsB | Audit web forms for personal/sensitive data, GET submissions, and pre-ticked consent. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| scan_project_filesB | Scan local project files for data models, deletion logic, PII logging, and SDKs. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| check_breach_readinessB | Audit repository documentation for breach response readiness and security contacts. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| detect_third_party_transfersB | Detect third-party analytics/tracking/payment domains and cross-border disclosures. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| run_full_auditC | Execute a full technical readiness audit against Sri Lanka PDPA No. 9 of 2022. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| generate_gap_reportC | Generate a formatted gap analysis report (Markdown or JSON) from an audit result. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
| list_checklistB | List technical readiness checklist rules and indicators for Sri Lanka PDPA. Use only on sites/projects you own or are authorised to audit. Defensive use only. Use this tool only on websites, endpoints, or local projects that you own or have explicit written authorization to audit. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool targets a distinct audit surface: privacy policy text, cookie consent markup, web forms, local project files, breach documentation, third-party domains, plus aggregation/reporting/checklist tools. The only mild overlap is run_full_audit versus the individual scan tools, but that granular-vs-aggregate split is a standard and understandable pattern.
All nine tools follow a strict snake_case verb_noun pattern (scan_*, detect_*, find_*, check_*, run_*, generate_*, list_*). Verb variation is semantically meaningful rather than arbitrary, so the naming stays predictable.
Nine tools is well within the ideal range and each earns its place: six specific audit checks, one orchestrator, one report generator, and one reference/checklist tool. Nothing feels padded or missing at the count level.
The surface covers the full audit lifecycle from individual checks through full audit to gap reporting, plus a checklist reference. Minor gaps remain: no tool to retrieve or persist prior audit results, no remediation/fix guidance beyond the gap report, and no explicit data subject request workflow check.