Skip to main content
Glama
goww7

ActTrace

by goww7
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

ActTrace

A developer-facing EU AI Act compliance API for non-financial SaaS and technology companies. ActTrace gives an engineering team three things, self-serve, over an API or via MCP:

  1. A deterministic risk classification of an AI feature under the EU AI Act.

  2. A ready-to-ship Article 50 transparency notice.

  3. A free diagnostic as the public entry point.

Not legal advice. ActTrace provides operational compliance workflow support and documentation drafts. It does not provide legal advice, does not certify compliance, and does not replace review by qualified counsel. Every response carries this disclaimer.

ActTrace is scoped for non-financial companies. Financial-services use cases (banking, trading, portfolio/investment advice, credit scoring, …) are deliberately classified out_of_scope_financial_services.

Install — Claude Code plugin / MCP server

ActTrace ships as a Claude Code plugin: an acttrace skill plus a local MCP server. The MCP server runs via uvx — a deterministic rules engine, offline, no API key.

/plugin marketplace add goww7/acttrace
/plugin install acttrace@acttrace

Then ask Claude "Is my chatbot EU AI Act compliant?" or "Write an Article 50 notice for our support assistant." The MCP server also runs standalone with any MCP client: uvx acttrace-mcp.

Related MCP server: employment-ai

Quickstart

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/uvicorn acttrace.app:app --reload --port 8080
# 1. Free diagnostic — no key needed
curl -s localhost:8080/api/acttrace/diagnostics/free -H 'content-type: application/json' -d '{
  "feature_name": "AI reply assistant",
  "description": "Drafts suggested customer support replies for agents.",
  "user_facing": true, "model_provider": "OpenAI", "use_case": "support_assist"
}'

# 2. Mint an API key
KEY=$(curl -s -XPOST localhost:8080/api/keys/generate | python3 -c 'import sys,json;print(json.load(sys.stdin)["api_key"])')

# 3. Classify (15 tokens)
curl -s localhost:8080/api/acttrace/classify -H "X-API-Key: $KEY" -H 'content-type: application/json' -d '{
  "feature_name": "AI reply assistant",
  "description": "Drafts customer support replies shown to agents.",
  "use_case": "support_assist", "user_facing": true, "model_provider": "OpenAI"
}'

# 4. Generate an Article 50 notice (10 tokens)
curl -s localhost:8080/api/acttrace/notices -H "X-API-Key: $KEY" -H 'content-type: application/json' -d '{
  "ai_system_name": "Support Copilot", "notice_type": "chatbot", "tone": "plain"
}'

Endpoints

Method & path

Auth

Tokens

Purpose

POST /api/acttrace/diagnostics/free

none

0

Public risk diagnostic

POST /api/acttrace/classify

key

15

Documented risk classification

POST /api/acttrace/notices

key

10

Article 50 transparency notice

POST /api/keys/generate

none

0

Issue a free-plan key

GET /api/health

none

0

Liveness

Auth is X-API-Key. Responses carry X-Request-ID, X-Plan, X-Tokens-Charged, X-Tokens-Remaining, X-RateLimit-*. Errors are structured {"code","message","detail"} (401/403/429).

MCP

python -m acttrace.mcp_server --sse --port 8002 exposes two tools — acttrace_classify and acttrace_generate_transparency_notice — authenticated with the same X-API-Key. A Claude Code skill is in skill/acttrace/.

Tests

.venv/bin/python -m pytest -q

54 tests: classification engine (7 acceptance fixtures), conflict guard, notice generator, and HTTP API contract.

Deploy

docker-compose.yml builds a standalone two-container stack (API + MCP) on ports 8080 / 8002 with its own volume — isolated from FinanceData2. To go live, append caddy-acttrace.snippet to the shared Caddyfile (replace the placeholder domain). See BLUEPRINT.md for the full build contract.

Layout

acttrace/
  app.py config.py dependencies.py
  middleware/   api_key_auth.py
  routers/      acttrace.py  keys.py
  services/     acttrace_service.py  acttrace_classification_service.py
                acttrace_notice_service.py  acttrace_constants.py
                api_key_service.py
  repositories/ acttrace_repository.py  api_key_repository.py
  schemas/      acttrace.py
  mcp_server/   server.py  __main__.py  context.py  tools/acttrace.py
skill/acttrace/ SKILL.md  README.md
tests/

Available Tools

2 tools
acttrace_classifyA

Classify an AI feature's EU AI Act risk category.

Runs ActTrace's deterministic classification engine and returns a risk category (prohibited, possible_high_risk, limited_risk_transparency, minimal_risk, unknown, or out_of_scope_financial_services) with confidence, rationale, triggering facts, missing information, obligations, and source references.

Use this when asked "Is this AI feature EU AI Act compliant?", "What risk tier does my AI feature fall into?", or for a general AI Act risk classification.

ActTrace is for non-financial SaaS / technology products. Financial use cases are reported as out_of_scope_financial_services unless financial_override is set. The result is informational and is NOT legal advice.

Args: feature_name: Short name of the AI feature (e.g. "support chatbot"). description: What the feature does. Strongly recommended — an empty description yields an unknown verdict. use_case: Short use-case label (e.g. "support_assist"). user_facing: True if end users interact with the feature. eu_available: True if the feature is available to EU users. internal_only: True if the feature is for internal staff only. model_provider: Underlying model provider (e.g. "OpenAI"). Required for a confident verdict when the feature is user-facing. human_review_level: One of "none", "optional", "required_before_action", "required_after_action". automated_decision: True if the feature makes automated decisions. high_risk_domain: True if the feature operates in a high-risk domain (hiring, education, biometrics, etc.). sensitive_data: True if the feature processes sensitive data. financial_override: Set True to bypass the financial-services out-of-scope guard for a borderline non-financial feature.

ParametersJSON Schema
NameRequiredDescriptionDefault
feature_nameYes
descriptionNo
use_caseNo
user_facingNo
eu_availableNo
internal_onlyNo
model_providerNo
human_review_levelNo
automated_decisionNo
high_risk_domainNo
sensitive_dataNo
financial_overrideNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: runs deterministic classification engine, returns detailed fields, states limitations (empty description yields unknown), and clarifies the tool is informational, not legal advice. No hidden side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the essential purpose and then provides structured details. It is somewhat lengthy but well-organized, with each sentence serving a purpose. Could be slightly trimmed, but overall efficient given the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (12 parameters, regulatory sensitivity) and the presence of an output schema, the description is exceptionally complete. It covers purpose, usage, parameter details, output fields, scope restrictions, and a legal disclaimer. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. The 'Args:' section provides thorough explanations for all 12 parameters, including allowed values for human_review_level and guidance on when fields are required (e.g., model_provider for user-facing features). This adds critical meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Classify an AI feature's EU AI Act risk category.' It lists possible risk categories and specifies the scope (non-financial SaaS/technology products), distinguishing it from the sibling tool for generating transparency notices.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use: 'Use this when asked "Is this AI feature EU AI Act compliant?", "What risk tier does my AI feature fall into?", or for a general AI Act risk classification.' Also explains when not to use (financial services without override) and notes the result is not legal advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

acttrace_generate_transparency_noticeA

Generate an EU AI Act Article 50 transparency notice.

Produces user-facing copy that discloses AI use, plus a suggested placement, caveats, and a human-review recommendation.

Use this when asked for an "AI transparency notice", "Article 50 notice", "AI disclosure copy", or "chatbot AI disclaimer".

ActTrace is for non-financial SaaS / technology products. The generated notice is a starting draft and is NOT legal advice.

Args: ai_system_name: Name of the AI system / product the notice is for. notice_type: One of "chatbot", "ai_generated_content", "support_assist", "summarization", "synthetic_media", "internal_ai", "other". feature_name: Optional short name of the specific feature. tone: One of "plain", "formal", "developer_docs", "policy", "ui_microcopy". Defaults to "plain". language: Notice language. English ("en") only for the MVP. human_review_level: One of "none", "optional", "required_before_action", "required_after_action". When set to "required_before_action" the notice will not recommend extra human review. risk_category: Optional risk category from a prior classification to tailor the notice.

ParametersJSON Schema
NameRequiredDescriptionDefault
ai_system_nameYes
notice_typeYes
feature_nameNo
toneNoplain
languageNoen
human_review_levelNo
risk_categoryNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It explains the output (user-facing copy, placement, caveats, human-review recommendation) and notes the notice is a draft, not legal advice. However, it does not explicitly state that the tool is read-only or describe any side effects, permissions needed, or rate limits, leaving some transparency gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: it starts with the main purpose, then outlines output details, usage guidance, and parameter descriptions in a logical order. Every sentence adds value without redundancy, making it easy to scan for key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 parameters, 2 required, and an output schema, the description covers all aspects: input details, output content, usage context (domain, non-legal status), and constraints (language limitation for MVP). It provides enough information for an agent to invoke the tool correctly without relying on external documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully describes each parameter, including allowed values (e.g., notice_type options), defaults (tone, language), and optionality (feature_name, human_review_level, risk_category). This adds significant meaning beyond the raw schema, enabling correct parameter selection.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: generating an EU AI Act Article 50 transparency notice. It specifies the verb 'Generate' and the resource 'transparency notice', and distinguishes from the sibling tool 'acttrace_classify' by detailing the output content such as user-facing copy and placement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage examples ('AI transparency notice', 'Article 50 notice') and clarifies the tool's domain (non-financial SaaS/technology products) and limitations (not legal advice). It lacks explicit exclusions or alternative tool recommendations, but the context is clear enough for appropriate selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0
Disambiguation5/5

The two tools have clearly distinct purposes: one classifies risk categories, the other generates transparency notices. There is no overlap or ambiguity between them.

Naming Consistency4/5

Both tools use the 'acttrace_' prefix and snake_case. However, one uses a single verb 'classify' while the other uses a compound verb 'generate_transparency_notice', introducing minor inconsistency.

Tool Count3/5

With only 2 tools, the surface is minimal. While the domain is narrow, the count is borderline thin and may require more tools for a complete compliance workflow.

Completeness3/5

The tools cover classification and transparency notice generation, which are core needs. Missing are tools for reclassification, updating features, or more detailed obligation queries, leaving minor gaps.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/goww7/acttrace'

If you have feedback or need assistance with the MCP directory API, please join our Discord server