bidda-mcp
Bidda MCP server lets you discover, verify, and govern regulatory compliance obligations from a source-verified registry of 10,000+ nodes across 39 pillars.
List compliance pillars and live node counts.
Search and fetch compliance nodes by keyword, ID, jurisdiction, topic, or MITRE technique.
Explore dependency chains, cross-framework mappings, and jurisdiction-specific bundles.
Track latest regulatory changes and obligation-level deltas.
Run pre-flight action compliance checks with LOW/MODERATE/HIGH risk indicators.
Compare how jurisdictions address a topic side by side.
Create signed attestations for rules relied on and controls mapped to obligations.
Open, record, seal, and retrieve tamper-evident run ledgers for agent decisions and conversations.
Consult full nodes inside governed runs with hash-pinned proof of what was read.
Export audit packs and NIST OSCAL assessment-results for GRC/audit tooling.
Check cached-rule drift, detect coverage gaps, and subscribe to change alerts via email or webhook.
Some subscriber and governance tools require a Bidda subscription key (free trial counts).
Bidda Sovereign Intelligence MCP Server
10,000+ source-verified regulatory compliance nodes across 39 sovereign pillars. Built to reduce hallucination by grounding every node in primary legal sources.
Actively maintained. Last reviewed 2026-10-14 - 10,099 nodes across 39 pillars, 25 MCP tools (server v1.7.0). Live counts always available via list_pillars() and GET https://bidda.com/mcp.
What is Bidda?
Bidda is a sovereign compliance intelligence registry. Every node traces to a primary legal source (avg 7 citations per node) and contains machine-executable deterministic logic, not summaries, not PDFs, not paraphrased commentary.
Pillars covered: EU AI Act · GDPR · NIST AI 600-1 · Basel III · HIPAA · DORA · FATF · SOC 2 · ISO 27001 · CCPA · PIPEDA · APRA CPS 234 · MiCA · POPIA · plus a MITRE layer across ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS and CAPEC, and 150+ others across 39 compliance domains.
Related MCP server: brehon-mcp-server
MCP Endpoint
POST https://bidda.com/mcp
GET https://bidda.com/mcp (server info, open this in a browser to inspect)Transport: Streamable HTTP (MCP 2025-03-26). No API key required for the discovery tier.
Tools (25)
Free discovery and intelligence (no key required)
Tool | Description |
| List all 39 compliance pillars with live node counts |
| Search by keyword across 10,000+ nodes; returns title, ID, pillar, and BLUF (plain-language obligation) |
| Fetch a specific node by ID; returns summary plus link to machine-executable workflow |
| Walk the prerequisite chain for a node (1 to 4 hops). Plan a full compliance posture from one entry node. |
| Cross-framework mapping dimensions for a node (e.g. GDPR Art 17 to CCPA right-to-delete to POPIA Sec 24) |
| Regulatory change feed: most recently updated nodes, optional pillar filter |
| All nodes that apply in a specific jurisdiction (EU, US, UK, AU, SG, IN, CA, CN, ZA, JP, BR and others) |
| MITRE technique ID to Bidda node plus mapped NIST/ISO/PCI/HIPAA/NIS2/DORA controls. Across 6 frameworks. |
| Pre-flight runtime check. Describe an intended action in natural language; get ranked applicable regulations plus LOW/MODERATE/HIGH risk indicator. |
| Browse the registry by cross-cutting compliance topic (e.g. data breach notification, AI transparency) across every pillar and jurisdiction |
Subscriber tools (pass your Bidda key as api_key; a free trial counts)
Tool | Description |
| Compare how jurisdictions address a topic side by side, including where their numeric thresholds differ (e.g. a breach-notification deadline of 72 hours versus 30 days). Does not rank which is stricter. |
| Create a signed, time-stamped record of which rules a person or AI agent relied on for a decision, with a public verify URL |
| Signed record of which committed version of a rule was authoritative at a past date, anchored to the public history chain |
| Subscribe to email or webhook alerts when a watched rule or pillar's primary source changes |
| Open a run ledger for a whole task or conversation (for example a support-bot chat). Returns a run_id. |
| Append one tamper-evident entry to an open run: the rules consulted, the decision, and the user input as text or a private hash |
| Seal a run into one signed run receipt covering every entry, with a public verify URL anyone can check against Bidda's public key |
| Fetch a run and its entries; a sealed run is publicly readable and reports whether its signature is valid |
| Governed runs: fetch a full node and record a verified, hash-pinned entry in an open run in one call, so the sealed receipt proves exactly which version of the rule the agent read |
| Export a sealed run as one auditor-ready evidence pack: the signed receipt, the entry chain, and an independent integrity self-check |
| Check whether a cached compliance snapshot is still current: pass node ids (optionally with version or content hash) and get fresh, drifted, or withdrawn per node |
| Signed record mapping one of your internal controls to the Bidda obligations it addresses, with owner, framework, status, and a public verify URL. An audit trail, not a determination of compliance. |
| Walk the public dependency graph from the nodes you cover to surface prerequisite obligations you may be missing |
| Obligation-level feed of which primary sources changed or were withdrawn since a date, filterable by pillar or node |
| Export a sealed governed run as a NIST OSCAL assessment-results document for GRC tooling |
The discovery responses for every free tool are free. Full vault unlock (deterministic_workflow, actionable_schema, full primary_citations) costs $0.01 per node via Skyfire JWT or USDC on Base. The subscriber tools require an active Bidda subscription, which includes a free trial.
Quick Start: Claude.ai / Claude Desktop / Cursor / any MCP HTTP client
Point your MCP client at:
https://bidda.com/mcpThat is it: no install, no API key, no config file for the discovery tier. The full server-info manifest is available at GET https://bidda.com/mcp (open in a browser to inspect available tools).
Run it locally (Node or Docker)
This repo also ships a runnable local stdio MCP server (server.js) that declares the full 25-tool surface. The free discovery and intelligence tools run locally by calling the public Bidda REST API, with no API key. The subscriber and governance tools are declared with their full schemas and execute on the hosted endpoint at https://bidda.com/mcp with your Bidda key. Use it when you want the server running on your own machine or CI.
With Node (18+):
npm install
node server.jsWith Docker:
docker build -t bidda-mcp .
docker run -i --rm bidda-mcpClaude Desktop / Cursor config:
{
"mcpServers": {
"bidda": {
"command": "node",
"args": ["/absolute/path/to/bidda-mcp/server.js"]
}
}
}The local server declares all 25 tools. Ten run locally with no API key: list_pillars, search_nodes, get_node, get_dependency_chain, get_crosswalk, get_mitre_mapping, get_jurisdiction_bundle, browse_topics, get_latest_changes, and check_action_compliance. compare_jurisdictions uses your Bidda key when the comparison is gated. The remaining subscriber and governance tools (attestations, the run ledger, change alerts, drift checks, and OSCAL export) require a Bidda subscription key and execute on the hosted endpoint at https://bidda.com/mcp; a free trial counts.
Example Queries
list_pillars()
search_nodes("GDPR data breach notification 72 hours")
search_nodes("Basel III capital requirements", pillar="Banking & Global Finance")
get_node("eu-ai-act-article-13-transparency")
get_dependency_chain("nist-csf-2-0-govern", max_depth=3)
get_crosswalk("gdpr-article-17-right-to-erasure")
get_jurisdiction_bundle("singapore", limit=25)
get_mitre_mapping("T1566") # ATT&CK Enterprise (phishing)
get_mitre_mapping("AML.T0020") # ATLAS (AI-specific)
check_action_compliance("process EU resident biometric data", jurisdiction="eu")
browse_topics("data breach notification")
compare_jurisdictions("data breach notification", api_key="YOUR_BIDDA_KEY")
create_attestation(agent="loan-bot-v2", nodes=["gdpr-article-22-automated-decisions"], api_key="YOUR_BIDDA_KEY")
open_run(agent="acme-support-bot", label="chat 8f21", api_key="YOUR_BIDDA_KEY")
record_run_entry(run_id="run_...", nodes=["gdpr-article-17-right-to-erasure"], note="User: delete my data", api_key="YOUR_BIDDA_KEY")
seal_run(run_id="run_...", api_key="YOUR_BIDDA_KEY")Coverage (live numbers via list_pillars())
Pillar | Approx. nodes |
Cybersecurity | ~1,900 |
Legal & IP Sovereignty | ~700 |
Banking & Global Finance | ~580 |
AI Governance & Law | ~570 |
Medical & Healthcare | ~325 |
Sustainability & ESG | ~285 |
Workplace | ~280 |
+ 32 more pillars | (call list_pillars) |
For exact live counts, call list_pillars(). The manifest at GET https://bidda.com/mcp returns the current totals dynamically.
Full coverage browser: bidda.com/intelligence
How Bidda reduces hallucination
Nodes are produced by Bidda's internal deterministic pipeline: source parsers and verification scripts do the heavy lifting, AI assists only in a small, tightly-gated drafting step, and every node passes multiple independent verification gates before publication. The whole design exists to keep drift to a minimum.
Every node has:
Primary legal citations: real instruments, real URLs, real section numbers (avg 7 per node)
Deterministic workflow: machine-executable steps, not prose summaries
Integrity hash: a cryptographic fingerprint of the node content
Source integrity watcher: regular TLS and content fingerprint checks against live regulator URLs, results published at
/api/v1/registry-health.jsonVerbatim mandate on amendments: every regulatory amendment is quote-justified against the source text before it can change a node
No inference without a regulatory anchor. No blog posts. No secondary commentary. No Wikipedia. Bidda is an information tool, not legal advice; review each rule and its primary source before relying on it.
CISA Secure by Design
Bidda has signed the CISA Secure by Design Pledge, the seven public goals the U.S. Cybersecurity and Infrastructure Security Agency asks software manufacturers to commit to, and publishes its evidence against each goal. Additional Bidda and CISA mappings:
CISA CPG crosswalk: bidirectional mapping between Bidda compliance nodes and CISA's Cybersecurity Performance Goals: bidda.com/cisa/cpg-crosswalk
CISA Free Tools catalogue: no-cost capabilities Bidda offers federal, SLTT and critical-infrastructure defenders: bidda.com/cisa/free
Registry Health
GET https://bidda.com/api/v1/registry-health.jsonLive integrity-check results: source URL liveness, verification coverage percentage, regulatory change detection categories, with a public timestamp on the last sweep.
Links
Website: bidda.com
Developer docs: bidda.com/developers
Full node registry: bidda.com/intelligence
CISA programs: bidda.com/cisa
Verify a node: bidda.com/verify
Methodology: bidda.com/methodology
Contact: info@bidda.com
Available Tools
15 toolsbrowse_topicsA
Browse the registry by cross-cutting topic (for example 'data breach notification', 'AI transparency', 'AML and KYC', 'logging and monitoring') across every pillar and jurisdiction. Returns each topic with its node, pillar, and jurisdiction counts. Topics sit on top of the 39 pillars without replacing them.
Inputs: query.
check_action_complianceA
Pre-flight compliance check: describe an intended action in natural language (for example 'process EU resident biometric data' or 'deploy an autonomous trading model in Singapore') and get a ranked list of regulations that may apply plus a risk indicator (LOW, MODERATE, or HIGH). The headline runtime gate for autonomous agents.
Inputs: action (required), limit, jurisdiction.
compare_jurisdictionsA
Compare how different jurisdictions address a compliance topic side by side, including where their numeric thresholds differ (for example a breach-notification deadline of 72 hours versus 30 days). It surfaces the real rules and numbers; it does not rank which jurisdiction is stricter. Uses your Bidda subscription key when provided (a free trial counts).
Inputs: topic (required), api_key.
consult_nodeA
The one-call governed turn: fetch the full vault node (this consumes one call on your key, exactly like unlocking a node) and record a verified node_consulted entry for it on an open run, in a single step. The entry pins the node to its current version and integrity hash, so the run receipt proves what the agent actually consulted. Use this instead of get_node when you are inside a run. Requires a Bidda subscription key (a free trial counts).
Inputs: run_id (required), api_key (required), node_id (required), model, +5 more.
create_control_attestationA
Sign a tamper-evident record of one of your own controls or policies and the Bidda obligation nodes it maps to. Each obligation is pinned to its current version and integrity hash at signing time, so the record shows what the control was mapped against on that date. This is the design-side evidence; run receipts are the operating-side evidence. Requires a Bidda subscription key (a free trial counts).
Inputs: nodes (required), api_key (required), control (required), statement (required), +5 more.
drift_checkA
Check whether compliance rules an agent has cached in its own memory are still current. Submit each node_id with the integrity hash you stored when you last grounded on it; get back, per rule, whether it is fresh, has drifted (content changed), or was withdrawn (instrument repealed), so the agent re-grounds before acting on stale rules. Requires a Bidda subscription key (a free trial counts).
Inputs: anchors (required), api_key (required).
get_audit_packA
Export a run as a governance evidence pack: the signed receipt, every entry, a roll-up of the nodes consulted (with pinned versions and hashes), an independent hash-chain and Merkle integrity self-check, and a coversheet mapping the receipt to the record-keeping obligations it supports (EU AI Act Art. 12 and 26, ISO/IEC 42001, NIST AI RMF). A sealed run is readable by id; a still-open run's draft pack needs your api_key.
Inputs: run_id (required), api_key.
get_jurisdiction_bundleA
List the compliance nodes that apply in a specific jurisdiction (for example EU, US, UK, Australia, Singapore, India, Canada, China, South Africa, Japan, Brazil). Use when an agent enters a new market and needs the regulatory surface for that geography.
Inputs: jurisdiction (required), limit.
get_latest_changesA
Regulatory change feed: primary sources whose documents changed within the tracking window, with counts by status. Use to see what recently moved before relying on a cached rule.
Inputs: limit.
obligation_deltasA
The obligation-level change feed: primary sources whose content changed (or whose node was withdrawn), mapped to the Bidda obligation nodes they affect, filterable by time, pillar, or specific nodes. Answers 'what obligations changed since I last reviewed?'. Requires a Bidda subscription key (a free trial counts).
Inputs: api_key (required), limit, nodes, since, +1 more.
oscal_assessment_resultsA
Export a governed run's evidence as a NIST OSCAL assessment-results document (the machine-readable format GRC and audit tooling consumes): reviewed-controls (the obligation nodes consulted), observations (each pinned to its version and integrity hash), and props recording the independent integrity self-check. A sealed run is readable by id; a still-open run needs your api_key.
Inputs: run_id (required), api_key.
point_in_timeA
Get a signed record of which committed version of a rule was authoritative at a specific past date, anchored to the public history chain. Useful when an agent must show what a rule said at the moment it acted. Requires a Bidda subscription key (a free trial counts).
Inputs: api_key (required), node_id (required), as_of.
record_run_entryA
Append one entry to an open run: which Bidda rules the agent consulted, what it decided, and the end user's input (as text via note, or privately as input_hash). Each entry is hash-chained to the previous one. Requires a Bidda subscription key (a free trial counts).
Inputs: run_id (required), api_key (required), note, model, +8 more.
search_nodesA
Keyword search across the Bidda registry of source-verified compliance obligations. Returns matching nodes with their id, title, pillar, and a plain-language summary (BLUF). Every node traces to a primary legal source. Use to find the rule that governs a topic, law, standard, or MITRE technique. Examples: 'GDPR breach notification 72 hours', 'Basel III capital', 'SOC 2 Type II'.
Inputs: query (required), limit, pillar.
watch_changesA
Subscribe to regulatory change alerts: watch specific rules and/or whole pillars and get notified by email or webhook when their primary source changes. Requires a Bidda subscription key (a free trial counts).
Inputs: api_key (required), label, nodes, pillars, +2 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 15 tools
Each tool targets a distinct compliance function: browsing, compliance checking, jurisdiction comparison, node consultation, attestation, drift detection, export, etc. No two tools overlap in purpose; descriptions clearly differentiate them.
Most tools follow a verb_noun pattern (e.g., browse_topics, check_action_compliance). 'obligation_deltas' breaks this pattern (noun_noun), but the deviation is minor and the overall style remains consistent.
With 15 tools, the server covers a complex domain (regulatory compliance) without being overwhelming. Each tool has a clear purpose, and the number is appropriate for the scope.
The tool surface covers discovery, compliance checking, attestation, monitoring, and export. Minor gaps exist (e.g., no node update/delete), but core workflows like search, assessment, and audit are well-supported.
Maintenance
Related MCP Connectors
Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR, Cyber Resilience Act and AI Act.
10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).
Verified, tier-0 regulatory data for AI across 850+ official sources and 50+ jurisdictions.
Multi-jurisdictional AI compliance readiness scoring with sourced penalty math.
Related MCP Servers
- AlicenseBqualityDmaintenanceTracks AI regulations, deadlines, risk assessments, and policy updates across multiple global jurisdictions, helping users stay compliant with evolving AI laws.68 npmMIT

brehon-mcp-serverofficial
AlicenseNot gradedqualityDmaintenanceProvides AI assistants with real-time, structured access to 32 privacy and AI governance laws across 28 jurisdictions to prevent hallucination in compliance answers.9 npmMIT- AlicenseNot gradedqualityDmaintenanceComputes multi-jurisdictional AI compliance readiness scores with sourced penalty math, enabling gap analysis and audit tier recommendations.MIT
- AlicenseNot gradedqualityBmaintenanceProvides AI assistants with verified regulatory data from 850+ official sources across 50+ jurisdictions, enabling accurate compliance research.MIT