Skip to main content
Glama
Sign In
receipts-compliance-mcp-mit

receipts-compliance-mcp-mit

by christiaan839-beep
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

receipts-compliance-mcp-mit

A local MCP server and Claude Desktop Extension. It verifies signed AI-agent receipt bundles and turns a set of receipts into auditor-ready Markdown reports. It runs offline; receipts are never uploaded.

Tools

Tool

Output

verify_manifest

Checks a MANIFEST.signed.json against an Ed25519 public key (PEM). Does not check the ML-DSA-65 half of a v3 signature.

build_annex_iv

EU AI Act Annex IV technical documentation

build_iso_42001

ISO/IEC 42001:2023 AI management system report

build_iso_23894

ISO/IEC 23894:2023 AI risk management report

build_nist_ai_rmf

NIST AI RMF 1.0 profile

build_soc2_evidence

SOC 2 Trust Service Criteria evidence binder

build_gdpr_dpia

GDPR Article 35 DPIA and Article 30 Records of Processing

build_hipaa_security

HIPAA Security Rule evidence binder

build_eu_cra

EU Cyber Resilience Act report

create_constitution, build_constitution_audit

Sign an AI constitution; audit receipts against it

Sections that need operator narrative are left as marked stubs. The reports are evidence summaries, not legal advice or a certification.

Related MCP server: agent-receipts-mcp

Privacy

Everything runs on your machine. The extension makes no network requests, collects no telemetry and stores nothing. Receipts and keys you pass to a tool are processed in memory and returned to Claude.

Install

Download receipts-compliance.mcpb from a release and open it in Claude Desktop. To build it yourself:

npm install
npm run pack:mcpb

Develop

npm test          # vitest
npm run typecheck
npm run build     # bundles dist/server.js

Receipts are JSON objects with verdictId, overall (pass, warn or block) and issuedAt; see src/types.ts.

Licence

MIT. See LICENSE.

Available Tools

11 tools
build_annex_ivA

Build an EU AI Act Annex IV technical-documentation report from a set of VAOS receipts. Article 11 of Regulation (EU) 2024/1689 requires this for every high-risk AI system. Returns Markdown ready to file with the EU AI Office.

Inputs: system (required), receipts (required), nextReportDue, operatorActions.

build_constitution_auditA

Audit a VAOS receipt set against a signed AI constitution. The constitution is a content-addressed (SHA-256) document of inviolable rules; receipts commit to its hash. This tool surfaces every receipt that violated a constitutional article, ranked by severity. Use it when you want to prove (or disprove) an autonomous agent followed its policy.

Inputs: receipts (required), constitution (required).

build_eu_craA

Build an EU Cyber Resilience Act (Regulation (EU) 2024/2847) compliance report from a VAOS receipt set. Maps every Annex I essential cybersecurity requirement + Article 13/14 obligation to receipt-derived evidence. Surfaces open findings.

Inputs: scope (required), receipts (required), residualRisks, implementationStatus.

build_gdpr_dpiaA

Build a GDPR Article 35 DPIA + Article 30 RoPA report from operator-declared processing activities + a VAOS receipt set. Returns Markdown ready for the DPO + supervisory authority. High-residual-risk activities automatically flagged for Article 36 prior consultation.

Inputs: risks (required), receipts (required), activities (required), controller (required).

build_hipaa_securityA

Build a HIPAA Security Rule (45 CFR § 164.308-318) evidence binder from a set of VAOS receipts. Maps every implementation specification to receipt-derived evidence. REQUIRED specifications without evidence are surfaced as findings; ADDRESSABLE specifications can be marked alternative-implemented with an operator note.

Inputs: scope (required), receipts (required), implementationStatus.

build_iso_23894A

Build an ISO/IEC 23894:2023 AI risk-management report from operator-declared risk scenarios + a VAOS receipt set. Computes inherent + residual risk per scenario via the 5×5 likelihood × impact matrix, attenuated by receipt evidence count. Returns auditor-ready Markdown.

Inputs: scope (required), receipts (required), scenarios (required).

build_iso_42001A

Build an ISO/IEC 42001:2023 AI management system (AIMS) report from a set of VAOS receipts. Covers clauses 4-10 + the 38-control Annex A matrix. Returns Markdown ready to hand to your certification body (BSI, TÜV SÜD, etc.).

Inputs: scope (required), receipts (required), retentionDays, operatorActions.

build_nist_ai_rmfA

Build a NIST AI RMF 1.0 profile (GOVERN / MAP / MEASURE / MANAGE) from a set of VAOS receipts. The de-facto US federal AI risk-management standard. Returns Markdown with per-subcategory evidence counts and trustworthy-AI characteristic coverage.

Inputs: scope (required), receipts (required), maturityOverrides, functionNarratives.

build_soc2_evidenceA

Build a SOC 2 evidence binder mapped to AICPA Trust Service Criteria (2017) — security (CC1-CC9), availability (A1), processing integrity (PI1), confidentiality (C1), privacy (P-series). Each criterion gets a receipt-derived evidence count + days-of-coverage metric. Returns Markdown to walk into the audit kickoff with.

Inputs: scope (required), receipts (required), controlOwners, coverageThresholdDays.

create_constitutionA

Sign a new AI constitution. Returns a SignedConstitution whose hash field is the content-addressed identifier. Every receipt produced under this constitution should commit to this hash. The constitution itself is byte-deterministic — anyone can re-derive the hash given the same articles + name + signedBy.

Inputs: name (required), articles (required), signedBy (required), preamble.

verify_manifestA

Verify a signed receipt bundle manifest (MANIFEST.signed.json) against an Ed25519 public key. Recomputes the manifest hash and checks the signature. Use before building a report from a receipt set you did not produce yourself. Does not check the ML-DSA-65 half of a v3 signature.

Inputs: manifest (required), publicKeyPem (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4/5.0

    Scored across 11 tools

    Disambiguation4/5

    Each build_* tool targets a named, distinct regulatory framework (Annex IV, ISO 42001, NIST AI RMF, SOC 2, GDPR DPIA, HIPAA, ISO 23894, EU CRA), so selection is mostly clear from the name alone. The only real friction is the cluster of AI-risk/governance reports (build_iso_23894 vs build_nist_ai_rmf, build_annex_iv vs build_iso_42001), where an agent must read descriptions to pick the right one.

    Naming Consistency5/5

    All tools are snake_case verb_noun with a small set of verbs (verify_, create_, build_) used uniformly. The pattern is predictable: build_<framework> for report generation, verify_/create_ for the manifest and constitution primitives.

    Tool Count5/5

    11 tools sits squarely in the well-scoped range. Each build_* tool corresponds to a genuinely different compliance artifact rather than being a redundant variant, and the two non-build tools (verify_manifest, create_constitution) anchor the receipt/constitution lifecycle.

    Completeness3/5

    The report surface is broad, but the underlying receipt lifecycle has notable gaps: there is no create_receipt or list/get_receipt, no verify_constitution or verify_receipt equivalent, and verify_manifest explicitly does not check the ML-DSA-65 half of v3 signatures. Agents can build reports but have limited ability to inspect, verify, or manage the receipt sets and constitutions they depend on.

    Resources

    Related MCP Connectors

    Related MCP Servers

    • agent-receipts-mcp

      dhanushs1912-svg
      A
      license
      A
      quality
      C
      maintenance
      Provides tools to issue, verify, and export cryptographically signed receipts for AI agent actions, enabling tamper-proof audit trails for compliance with regulations like the EU AI Act.
      4
      58 npm
      1
      MIT

    • Proof Layer MCP

      World-999-Labs
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.
      MIT

    • io.github.Medxpert-org/ubic

      Medxpert-org
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI agents and builders to run local, audit-traceable governance assessments, including an A³ scorecard, ISO/IEC 42001 and NIST evidence templates, compliance checklists, passport lookup, and sensitive-text screening.
      MIT