ListGuard
Provides compliance auditing for Amazon listings via the amazon-us rule pack, checking prohibited promo words, absolute claims, certification and trademark risks, and AI content disclosure. Supports single or batch audits, severity hits, rewrite suggestions, and CI-ready SARIF output.
Provides compliance auditing for TikTok listings via the tiktok-us rule pack, detecting platform-risk terms, absolute claims, certification issues, and AI disclosure problems. Supports auditing, rule search, and rewrite suggestions with CI-ready exit codes.
listguard-zhuyt
跨境电商 Listing 合规审计引擎。给 listing 文案做 lint,在商品被平台扫描、下架、封店之前把问题拦下来。
为什么做这个
2026 年跨境平台的合规压力是实打实的:
亚马逊 2026-08 起强制 AI 内容披露,存量 listing 补披露的截止时间是 2026-11-01,漏报按违规处理
平台 AI 扫描对违禁词、绝对化用语的识别准确率已到 89%,靠人工肉眼审文案已经追不上
绝对化疗效声明(cure / heals / best seller / 全网最低价)是下架和封店的高频原因
代运营公司和客服外包商已经在养专职合规专员——这个岗位每天做的事情,就是本工具自动化的那部分
listguard 把这件事变成代码:规则即文件、审计即命令、阈值即退出码。可以本地跑,也可以直接卡进 CI 流水线。
Related MCP server: genpark-automated-compliance-policy-evaluator-skill
它能查什么
内置三个版本化规则包(amazon-us / temu-global / tiktok-us),覆盖:
违禁词与促销词:free shipping、best seller、全网最低价、手慢无……
绝对化声明:cure、heals、100%、organic(无认证场景)等,按平台风险分级
认证与商标风险:无证书的认证声明、品牌词擦边
AI 内容披露:aiDisclosure 字段缺失或取值非法直接标黄(2026 新规)
匹配引擎不是简单的关键字包含,而是三级匹配:
fold:全角转半角、大小写折叠、空白归一——
FREE逃不掉condense:剥掉混淆分隔符——
f-r-e-e shipping、全 场 最 低 价逃不掉regex:规则包里可以用
re:前缀写正则,带词边界防误报(cure不会误伤secure)
中文词(Temu 场景)做了专门的边界处理,命中词嵌在连续中文串里也能定位并给出移除建议。
快速开始
要求 JDK 21+ 和 Maven 3.9+。
mvn -DskipTests package
# 审计单条 listing
java -jar target/listguard.jar check examples/red-sample.json --platform amazon
# 批量扫描目录,输出 SARIF,阈值设为 yellow
java -jar target/listguard.jar check examples/ --platform amazon --format sarif --fail-on yellow
# 查看内置规则包
java -jar target/listguard.jar rules退出码:0 合规通过;1 命中阈值(或文件解析失败——解析不了就无法证明合规);2 用法错误。
listing JSON 格式见 examples,aiDisclosure 取值 human / assisted / ai_generated。
三种使用方式
除了上面的 CLI,还有两个零门槛入口:
在线检测台(无需安装)
web/listguard-listing-compliance-checker.html 是一个单文件网页:粘贴 listing 文案、选平台、点检测,
即时输出分级报告并在原文高亮命中片段。纯浏览器本地计算,文案不上传任何服务器。
它内置的 JS 引擎是 Java 实现的移植,用 web/tests/engine-parity.test.mjs 逐条比对,
命中项、分级、字段、建议文本与退出码语义与 CLI 完全一致(52 项断言)。规则数据同样是 YAML 的副本,
由 web/tests/rulepack-sync.test.mjs 防止两份数据漂移。
# 本地预览:直接双击 web/listguard-listing-compliance-checker.html 即可,
# 或起一个静态服务器(注意 npm start 是启动 MCP server,不是网页预览)
npx serve webMCP server(供 AI agent 调用)
mcp/server.mjs 把合规审计暴露为 4 个 MCP 工具,零 npm 依赖,走 stdio JSON-RPC:
工具 | 用途 |
| 审计一条 listing,返回分级、命中明细与等效 CI 退出码 |
| 列出支持的平台规则包与规则数 |
| 按关键词搜规则,回答「这条为什么被判违规」 |
| 把命中项转成按字段分组的改写建议 |
// Claude Desktop / Cline / Cursor 等
{ "mcpServers": { "listguard": { "command": "node", "args": ["<repo>/mcp/server.mjs"] } } }MCP server 复用 web/assets/ 下同一份引擎,判定语义与 CLI、在线页三者一致
(mcp/server.test.mjs 40 项断言校验协议与工具行为)。
npm test # 依次跑:引擎差分 + 规则同步 + MCP 协议,共 95 项断言CI 闸门
退出码就是闸门,放进流水线即可:
- name: Listing compliance gate
run: |
java -jar listguard.jar check listings/ --platform amazon --fail-on yellow--format sarif 的输出兼容 SARIF 2.1.0,可以直接作为 GitHub Code Scanning 的上传工件,命中项会以 error / warning 出现在 PR 检查里。
自定义规则包
规则包是 YAML,格式如下(完整示例见 src/main/resources/rules/):
name: amazon-us
platform: amazon
market: US
version: "2026.10"
updated: "2026-10-16"
rules:
- id: promo-free-shipping
category: promo_word
severity: RED
patterns:
- "free shipping"
- "re:\\bfree\\s+delivery\\b"
message: 促销词违反平台政策
suggestion: 删除促销表述,或改用平台官方折扣工具severity只接受RED/YELLOW(GREEN 保留给整体分级语义)patterns里re:前缀表示正则,其余按字面量做三级匹配category是固定枚举,见RulePackLoaderai_disclosure类规则不带 patterns,由披露检查器消费
用 --rules-dir 把自己的 YAML 目录追加到内置包之上,适合代运营商家放自家黑话词库。
LLM 改写建议(可选)
规则引擎给出确定性建议;advisor 包额外提供 LLM 语义改写(OpenAI 兼容接口),通过环境变量配置:
export LISTGUARD_LLM_BASE_URL=https://api.openai.com/v1
export LISTGUARD_LLM_API_KEY=sk-...
export LISTGUARD_LLM_MODEL=gpt-4o-miniLLM 只是增强层:不可用、超时、返回异常时静默降级,核心审计完全不依赖它。当前以库 API 形式提供(LlmRewriteAdvisor),CLI 集成在路线图中。
设计取舍
确定性优先:合规审计的价值在于可复现、可解释,每条命中都带规则 id 和依据;LLM 永远不做判定
依赖只有 4 个:picocli / snakeyaml / jackson-databind / junit,单个可执行 jar,没有框架
规则即版本化文件:词库更新走 code review,改了什么、为什么改,git log 里都有
路线图
MCP server / SDK(供 agent 工作流调用)→ 已交付
mcp/server.mjs(Node 实现,零依赖;原计划的 Python 版未做,因为 Node 版能直接复用已验证的网页引擎,避免出现第三份判定实现)免费在线检测台(零安装门槛的获客入口)→ 已交付
web/CLI 集成 LLM 改写建议(
--suggest)——LlmRewriteAdvisor已实现,CLI 尚未接线付费垂直规则包订阅(类目级:保健品、母婴、化妆品)
团队批量 API 与报告看板
批量与增量扫描性能(当前单机单进程)
商业化路径与渠道优先级见 docs/commercialization-plan.md。
License
MIT
Available Tools
4 toolsaudit_listingA
Audit a cross-border e-commerce product listing for compliance violations BEFORE it gets flagged or removed by the platform. Detects banned words, promo words, absolute claims (cure/heals/100%), unsupported certification claims (FDA/CE/organic), trademark risks, and missing AI content disclosure. Uses deterministic versioned rule packs — not an LLM — so every finding carries a rule id and rationale and is fully reproducible. Matching is three-level (fullwidth fold / obfuscation condense / regex with word boundaries), so "F-R-E-E shipping", "FREE", and "全 场 最 低 价" are still caught while "secure" is not falsely flagged as "cure".
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Product title | |
| failOn | No | CI gate threshold. The listing breaches the gate when overall severity reaches this level. Defaults to "red". | |
| bullets | No | Bullet points (Amazon five-point description) | |
| keywords | No | Search keywords (backend search terms) | |
| platform | Yes | Target platform rule pack. Available: amazon (amazon-us, market=US, 20 rules), temu (temu-global, market=GLOBAL, 15 rules), tiktok (tiktok-us, market=US, 15 rules) | |
| description | No | Product description / detail copy | |
| aiDisclosure | No | AI content disclosure status (Amazon 2026-08 rule). One of: "human" (fully human written), "assisted" (partially AI assisted), "ai_generated" (fully AI generated), or empty/null when not yet declared. Declare it honestly: claiming "human" while the copy shows dense AI traces is a RED finding. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that matching is deterministic and rule-pack-driven rather than LLM-based, that findings carry a rule id and rationale and are reproducible, and it explicitly addresses false-positive behavior ('secure' is not flagged as 'cure'). This goes well beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all front-loaded on the core purpose with escalating detail about detection scope and matching strategy. Dense but largely waste-free; the matching example sentence is long yet directly justifies the tool's reliability claim, so it earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by explaining the shape of findings (rule id plus rationale) and the severity model implied by failOn. Enough is present for an agent to call the tool and interpret results, though the exact finding payload structure is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all seven parameters including the platform rule-pack details and aiDisclosure semantics. The description adds the conceptual rule-pack framing but no parameter-specific syntax or edge-case guidance beyond what the schema provides, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (audit) applied to a specific resource (cross-border e-commerce product listing) and enumerates the exact violation classes detected. It is immediately distinguishable from siblings like search_rules and suggest_rewrite, which serve different phases of the workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the timing context ('BEFORE it gets flagged or removed by the platform'), which tells an agent when this tool belongs in a workflow. However, it never names an alternative tool or a when-not-to-use condition, so routing versus list_rule_packs/search_rules is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rule_packsA
List the available compliance rule packs with their platform, market, version, update date and rule count. Use this to discover which platforms are supported before calling audit_listing.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'List the available' strongly implies a read-only discovery call, but the description never states there are no side effects, whether it paginates, or an auth requirement, leaving real gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the first defines the operation and its return fields, the second gives the actionable next step. Nothing is redundant and the purpose leads the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully enumerates the returned fields, which compensates well. For a simple zero-param list tool the coverage is nearly complete, though it could note the read-only nature to fully stand in for the missing annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the baseline this scores 4. There is nothing for the description to disambiguate at the parameter level, and it commits no errors here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the available compliance rule packs') and enumerates exactly what each entry exposes (platform, market, version, update date, rule count). This lets an agent distinguish it from siblings like search_rules or suggest_rewrite without inspecting schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when to use it ('to discover which platforms are supported') and names the follow-up call (audit_listing), routing the agent correctly. It lacks explicit when-not guidance or mention of the other siblings, so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_rulesA
Search inside a rule pack by keyword. Returns matching rules with id, severity, category, patterns, rationale and fix suggestion. Useful to answer "why was this flagged?" or "what words are banned for supplements on Temu?".
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Keyword to match against rule id, patterns, message and suggestion. Empty returns all rules. | |
| platform | Yes | Rule pack to search. Available: amazon (amazon-us, market=US, 20 rules), temu (temu-global, market=GLOBAL, 15 rules), tiktok (tiktok-us, market=US, 15 rules) | |
| severity | No | Filter by severity. Defaults to ALL. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses the return shape (id, severity, category, patterns, rationale, fix suggestion) and implies a read-only lookup, but says nothing about authentication, pagination, result limits, or whether the search is substring/regex based.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: purpose, return contents, then motivating use cases. The essential verb+resource is front-loaded and no sentence is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description compensates by listing the returned fields, and all three parameters are fully documented in the schema. Minor gaps around result limits and query matching semantics keep it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so query, platform and severity are already fully documented including enum values and defaults. The description adds a natural-language example that subtly clarifies the query parameter's intent but no syntax beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search inside a rule pack by keyword') and enumerates the returned fields, so the agent knows exactly what the tool produces. It does not explicitly contrast itself with siblings like list_rule_packs or suggest_rewrite, which keeps it short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete usage contexts ('why was this flagged?', 'what words are banned for supplements on Temu?') that tell the agent when this tool is the right call. It stops short of naming alternatives or exclusions, so no 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
suggest_rewriteA
Turn audit findings into concrete rewrite guidance. For each finding it returns the offending fragment, why it violates platform policy, and the suggested replacement — grouped by field so the caller can patch the listing copy directly. Deterministic suggestions only (from the rule pack); this tool never invents copy.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Product title | |
| bullets | No | Bullet points | |
| keywords | No | Search keywords | |
| platform | Yes | Target platform rule pack | |
| description | No | Product description | |
| aiDisclosure | No | AI content disclosure status (Amazon 2026-08 rule). One of: "human" (fully human written), "assisted" (partially AI assisted), "ai_generated" (fully AI generated), or empty/null when not yet declared. Declare it honestly: claiming "human" while the copy shows dense AI traces is a RED finding. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose meaningful behavior: output is grouped by field for direct patching, and suggestions are deterministic from the rule pack with the strong guarantee that it "never invents copy." It does not cover permissions, rate limits, or what happens when optional fields are omitted, so it is not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the core purpose, then the return shape, then the determinism guarantee. Every sentence adds distinct information with no repetition of the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must describe returns, and it does (fragment, violation reason, replacement, field grouping). Combined with the determinism guarantee and full schema coverage on inputs, an agent has everything needed to call and interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the aiDisclosure enum semantics, required platform, and optional copy fields are all fully documented in the schema. The description's only added detail is that results are "grouped by field," which describes output shape rather than input semantics, so it stays at the baseline for a fully documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource (turn audit findings into rewrite guidance) with the output contract spelled out: offending fragment, policy rationale, and suggested replacement grouped by field. It implicitly distinguishes itself from audit_listing (which produces the findings) and the rule-pack siblings (which supply rules), so an agent can place it in the workflow without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "Turn audit findings into concrete rewrite guidance" clearly establishes the upstream dependency (it consumes audit output) and the intent to patch listing copy. However, it names no exclusion conditions and does not explicitly say when to prefer it over re-running audit_listing or browsing rules.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
audit_listing - First observed
list_rule_packs - First observed
search_rules - First observed
suggest_rewrite
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: audit_listing runs the compliance check, list_rule_packs discovers packs, search_rules queries inside a pack, and suggest_rewrite produces fix guidance. The workflow ordering (discover → search → audit → rewrite) is intuitive and leaves no real risk of misselection.
All four tools follow a consistent verb_noun snake_case pattern (audit_listing, list_rule_packs, search_rules, suggest_rewrite). Verb choice is predictable and the object is always clear.
Four tools is on the lean side but appropriate for a tightly scoped compliance-auditing server; each tool earns its place in the discover/audit/rewrite loop. It is not thin enough to feel incomplete for this narrow domain.
The surface covers the full pre-flagging workflow: discovering rule packs, querying rules, auditing a listing, and generating deterministic rewrites. Minor gaps exist (e.g. no batch/multi-listing audit or report export), but core lifecycle coverage is solid.
Maintenance
Related MCP Connectors
中文内容合规检查:广告法违禁词 + AI 标识规则,逐条给出法条依据。Chinese content compliance: ad-law banned terms + AI labeling.
Compliance lint for AI, scraping, and privacy law. Cited findings in 200 or more jurisdictions.
Source-cited EU/UK/US/AU market-access checks for Amazon and cross-border product compliance.
Audit creator scripts for TikTok Shop and Amazon policy violations. Returns flags and safe rewrites.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceThe only Multi-LLM Compliance Engine (GPT-4o + Claude + DeepSeek). Auto-fix GDPR/LGPD risks and more 15 frameworks. code.guard.eu3 npm1MIT
- FlicenseNot gradedqualityBmaintenanceEnables automated evaluation of e-commerce advertising content against compliance policies, detecting prohibited claims and trademarks through an MCP-compatible interface.8-
- FlicenseNot gradedqualityBmaintenanceEnables scanning e-commerce advertising content to detect prohibited claims and trademark violations, returning deterministic compliance evaluations for autonomous agents.7-
- FlicenseAqualityAmaintenance40 regulation-and-deadline linters (CRA/CSAF, PCI DSS 6.4.3, WCAG 2.1 AA, DORA, NIS2, EU AI Act, KSeF, NF-e) that AI agents call over MCP. Free checks on the open file; licence key unlocks workspace scan and CI exit code.3-