Skip to main content
Glama
Ansvar-Systems

Swiss Data Protection MCP

Swiss Data Protection MCP

The Swiss data-protection corpus is now served through the Ansvar Gateway. Connect your AI assistant (Claude, Copilot, Cursor, custom MCP client) to https://gateway.ansvar.eu/mcp — one OAuth connection, free tier available, covering this corpus plus EU regulations, national law across dozens of audited jurisdictions (Europe + the US), and CVE/security intelligence, every result with a verbatim source citation. Start at https://ansvar.eu/docs/quickstart

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth signup flow (setup details: ansvar.eu/docs/quickstart). After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Swiss data protection data for AI compliance tools.

License CI

Query Swiss data protection data -- regulations, decisions, and requirements from FDPIC/EDOB (Federal Data Protection and Information Commissioner) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: fedlex-mcp

Available Tools (6)

Tool

Description

ch_dp_search_decisions

Full-text search across FDPIC decisions and opinions (Sachverhaltsdarstellungen, Empfehlungen). Returns matching deci...

ch_dp_get_decision

Get a specific FDPIC decision or opinion by reference number.

ch_dp_search_guidelines

Search FDPIC guidance documents: Leitfäden, Erläuterungen, and guidance on cloud computing, new DSG, video surveillan...

ch_dp_get_guideline

Get a specific FDPIC guidance document by its database ID.

ch_dp_list_topics

List all covered data protection topics with German and English names. Use topic IDs to filter decisions and guidelines.

ch_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Swiss regulatory publications:

  • FDPIC/EDOB (Federal Data Protection and Information Commissioner) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by FDPIC/EDOB (Federal Data Protection and Information Commissioner). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/swiss-data-protection-mcp
cd swiss-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet coverage at ansvar.eu/coverage.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
ch_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It transparently states the tool returns metadata (version, data source, coverage, tool list) and implies no side effects. However, it does not mention any potential caching or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no wasted words. It is concise and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool returns server metadata with no complex output schema, the description covers all necessary return elements (version, data source, coverage, tool list). It is fully adequate for a simple introspection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so the description adds meaning by specifying what the tool returns. This is a baseline of 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns metadata about the MCP server, specifying version, data source, coverage, and tool list. It distinguishes itself from sibling tools that deal with decisions, guidelines, and topics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for obtaining server metadata, but it does not explicitly state when to use it over alternatives or provide exclusion criteria. Given the simplicity, the implication is sufficient but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ch_dp_get_decisionB

Get a specific FDPIC decision or opinion by reference number.

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesFDPIC decision reference (e.g., 'FDPIC-2013-001', 'EDÖB-2020-003')

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must carry the burden. It indicates a read operation ('Get') but does not disclose behavior on missing references, rate limits, or whether the full text or summary is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence. It is front-loaded and without filler, but could be slightly more informative without losing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read operation with one parameter and no output schema, the description is minimally complete. However, it lacks context about prerequisites or common usage patterns compared to sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds 'by reference number' which aligns with schema but does not provide new meaning beyond the schema's format example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'specific FDPIC decision or opinion', and the method 'by reference number'. It effectively distinguishes from sibling tools like ch_dp_search_decisions, which implies listing or searching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like ch_dp_search_decisions or ch_dp_get_guideline. The description assumes the user already has a reference number.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ch_dp_get_guidelineA

Get a specific FDPIC guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from ch_dp_search_guidelines results)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries full burden. It only states 'Get' (a read operation) but lacks details on error handling, permissions, or whether the operation is safe. No disclosure of side effects or state changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no extraneous information. It is appropriately front-loaded and concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-by-ID tool, the description is adequate but incomplete. It does not describe the output structure, return format, or what happens if the ID is invalid. No output schema exists to compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter description already explains the ID source. The tool description adds no further semantic value beyond what the schema provides, earning the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a specific FDPIC guidance document by database ID. It unambiguously identifies the resource and operation, distinguishing it from sibling tools like search or get_decision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after a search (mentioning ID from ch_dp_search_guidelines results) but does not explicitly state when to use this tool versus alternatives, nor does it provide when-not conditions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ch_dp_list_topicsA

List all covered data protection topics with German and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. The verb 'list' implies a read-only, non-destructive operation, and it specifies the output includes both German and English names, which is sufficient for this simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no fluff: first sentence states the purpose and output, second hints at usage. Well-structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema, and low complexity, the description is fully adequate—it tells the agent what the tool does and how to use the results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so schema coverage is 100%. The description doesn't need to explain parameters beyond what the empty schema provides, meeting the baseline for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists all covered data protection topics with German and English names, distinguishing it from sibling tools that search for decisions or guidelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions using topic IDs to filter decisions and guidelines, implying a downstream use case, but does not directly state when to use this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ch_dp_search_decisionsA

Full-text search across FDPIC decisions and opinions (Sachverhaltsdarstellungen, Empfehlungen). Returns matching decisions with reference, entity name, and DSG articles cited.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in German (e.g., 'Datenschutz Cloud', 'Google Street View', 'Einwilligung')
topicNoFilter by topic ID (e.g., 'cloud_computing', 'videoüberwachung', 'gesundheitsdaten'). Optional.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the burden. It mentions full-text search and German query requirement but does not disclose behavioral traits such as pagination, rate limits, or authentication needs. The slight inconsistency between mentioned document types and schema enum is noted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys purpose, document scope, and return content. No unnecessary words, and key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description usefully specifies return fields (reference, entity, DSG articles). The schema covers filtering by type and topic, so the agent has sufficient context for invocation. Minor inconsistency in document types mentioned does not severely impact completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description adds minimal extra parameter meaning beyond confirming the German language requirement for the query. The mention of return fields is about output, not parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Full-text search across FDPIC decisions and opinions', specifies the document types, and lists return fields (reference, entity name, DSG articles). This distinguishes it from sibling tools like ch_dp_search_guidelines (guidelines) and ch_dp_get_decision (single decision retrieval).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for searching decisions/opinions but does not explicitly state when to use this tool versus alternative sibling tools like ch_dp_search_guidelines or ch_dp_get_decision. No exclusion criteria or context are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ch_dp_search_guidelinesB

Search FDPIC guidance documents: Leitfäden, Erläuterungen, and guidance on cloud computing, new DSG, video surveillance, health data, cross-border transfers, and more.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in German (e.g., 'Cloud Computing', 'neues DSG', 'grenzüberschreitend')
topicNoFilter by topic ID (e.g., 'cloud_computing', 'neues_dsg', 'auftragsbearbeitung'). Optional.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description should disclose behavioral traits like read-only nature, authentication, or rate limits. It only says 'Search' (implied read-only) but does not explicitly confirm safety or mention any limitations, leaving significant gaps for a search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that conveys key information without fluff. It could benefit from slight restructuring (e.g., listing), but it is appropriately concise for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters, no output schema, and no annotations, the description lacks information about return format, pagination (limit parameter mentioned but not explained), error handling, or any constraints. It only provides examples, leaving the agent underinformed for reliable invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with all parameters described. The description adds valuable examples for the query parameter (e.g., 'Cloud Computing', 'neues DSG') and implies topics, going beyond the schema's generic descriptions. This helps agents form effective queries.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Search' and the resource 'FDPIC guidance documents', and lists specific document types (Leitfäden, Erläuterungen) and topics (cloud computing, new DSG). This distinguishes it from sibling tools like ch_dp_search_decisions (decisions) and ch_dp_get_guideline (single document).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like ch_dp_search_decisions or ch_dp_list_topics. It does not mention prerequisites or context that would help an agent choose correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: searching decisions, retrieving specific decisions, getting guidelines, listing topics, searching guidelines, and server metadata. No overlap in functionality.

Naming Consistency5/5

All tools follow a consistent 'ch_dp_' prefix with verb_noun pattern (e.g., search_decisions, get_decision). Even the 'about' tool fits the pattern as a service action. Uniform use of snake_case.

Tool Count5/5

With 6 tools covering search, retrieval, topic browsing, and metadata, the set is well-scoped for a specialized data protection legal research server. Neither too few nor excessive.

Completeness4/5

Core CRUD-like operations are present, but search tools may not support filtering by topic ID explicitly, which could be a minor gap. Otherwise, the surface covers the main workflows.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Ansvar-Systems/swiss-data-protection-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server