ReadyStack Compliance Linters (40 MCP servers)
Reads stylesheets and names the WCAG 2.2 success criterion each rule breaks.
Checks Dart source for Apple required-reason APIs, decoding reason codes.
Marks every column in Django models that a subject access request must reach, with the GDPR article each finding hangs on.
Marks base images in Dockerfiles, compose files, and CI workflows whose security patches stop by a date, with replacement tags.
Flags dependencies whose licences flipped, such as Elastic's 7.11 change, with the exact version where each flip happened.
Lints GitHub Actions workflow files against 25 dated GitHub shutdowns, such as the removal of Node 20 from hosted runners, naming the date each line will break.
Finds lines that make Google Play reject a release, with the date each gate closed.
Lints Hugging Face model cards against the Hub metadata spec and EU AI Act documentation duties.
Checks Kotlin source for Apple required-reason APIs, decoding reason codes.
Checks Kubernetes manifests for apiVersions that are no longer served by kubectl.
Applies seventeen rules on .tex files, including statements editorial offices look for and sources that break the publisher's build.
Find package.json lines that stop vsce from running release builds.
Finds settings that break when public TLS certificates fall to 100 days, including openssl -days usage.
Finds lines in plugin PHP that break privacy duties, with article and fix per line.
Marks every column in Prisma schemas that a subject access request must reach, with the GDPR article each finding hangs on.
Flags dependencies whose licences flipped, such as Redis 7.4+ SSPL, with the exact version where each flip happened.
Checks Swift source for Apple required-reason APIs, decoding reason codes.
Flags dependencies whose licences flipped, such as Terraform 1.6+ BUSL, with the exact version where each flip happened.
Marks every column in TypeORM entities that a subject access request must reach, with the GDPR article each finding hangs on.
Names lines where a TypeScript service writes personal data into logs, crash reports, and analytics.
Finds the 12 author-side privacy duties your plugin PHP breaks, with the article and fix on every line.
Audits invoice XML against e-invoicing mandates and SEFAZ acceptance rules.
Lints YAML configuration files for compliance issues, such as security headers and CSP lines that do nothing.
ReadyStack Compliance Linters — 40 MCP servers
Regulation- and deadline-aware linters (EU CRA / CSAF, PCI DSS 6.4.3, WCAG 2.1 AA, DORA, NIS2, EU AI Act, KSeF FA(3), NF-e, GitHub Actions EOL, TLS certificate lifetime, Kubernetes removed APIs …) that an AI agent calls over the Model Context Protocol (MCP).
Every folder in this repository is one npm package @readystack/<name>. The same package runs three ways: as a stdio MCP server (--mcp), as a CLI, and as a CI step. No network calls: every rule set ships inside the package and runs offline on the files you point it at.
Run as an MCP server (Claude Code · Cursor · Windsurf · any MCP client)
{ "mcpServers": { "k8s-removed-api-lint": { "command": "npx", "args": ["-y", "@readystack/k8s-removed-api-lint", "--mcp"] } } }The server speaks MCP over stdio (JSON-RPC 2.0, protocol version 2025-06-18: initialize, tools/list, tools/call). Tools exposed by every server: check_dir · check_file · check_text. check_text and check_file are free with no account; check_dir (the workspace sweep with an exportable report and a CI exit code) needs a licence key from https://getreadystack.com — the full sweep is free for the first 7 days. Each finding comes back with the file, the line number and the fix.
Registry names: io.github.jmshinhwa/<name> in the official MCP Registry (registry.modelcontextprotocol.io).
Related MCP server: Meridian
Run as a CLI or in CI
npx -y @readystack/k8s-removed-api-lint --file deploy.yaml # one file
npx -y @readystack/k8s-removed-api-lint --dir . --ci # whole repo, non-zero exit on findings (licence)Servers (40)
npm package | what it checks |
| Node 20 is removed from GitHub-hosted runners on 2026-09-23 and ubuntu-22.04 deprecation opens 2026-09-17. This checks a workflow file against 25 dated GitHub shutdowns and names the date each line st |
| Finds the LLM model IDs pinned in your code that vendors have already switched off, or have dated to switch off, with the replacement and the date. |
| A rejeição por falta de IBS/CBS foi suspensa em 31/07/2026: sua NF-e é autorizada mesmo errada. Este auditor lê o XML no editor e aponta o que a SEFAZ deixou passar. |
| Sixteen statutory checks on the signup page AB 2863 rewrote, in your editor and in the browser |
| Marks every base image in your Dockerfiles, compose files and CI workflows whose security patches have already stopped - or stop before 13 November 2026 - and prints the tag that replaces it. |
| Names every line in the file you have open that starts a recurring cloud charge, with the published us-east-1 price and the date it changes by itself. |
| Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT. |
| Names every schedule line in the file you have open that fires at the wrong hour, twice, or never at all - and prints the next three times each one really fires, in the zone that actually applies. |
| Finds the money lines that send the wrong amount to a payment API: the x100 that charges 100x in JPY, the toFixed(2) that truncates KWD, and the currency codes that stopped being legal tender. |
| Twenty-two checks over the ICT vendor contracts in your repository - every missing Article 30 clause named, with the wording to paste in. |
| 24 checks on the register CSV before it reaches the supervisor — LEI check digits, ISO dates and codes, references that resolve |
| Names every WCAG 2.2 AA form failure on its line, with the criterion and the fix |
| Lints UBL and CII invoice XML against EN 16931 and the national e-invoicing mandates that are live in 2026 |
| Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14. |
| Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA. |
| 12 checks for the French mandatory mentions a PDP rejects, on Factur-X, UBL and CII invoices |
| Audits a product feed row by row against Article 19 of the EU General Product Safety Regulation |
| 2026年9月30日で80%控除が終わります。10月1日からは50%ではなく70%です(令和8年度税制改正)。請求・仕入コードに残った 0.8 と 0.5、明細ごとの端数処理、T+13桁でない登録番号を、行番号と修正案つきで指摘します。 |
| 15 checks for the apiVersions kubectl no longer serves, on the manifest open in your editor |
| Seventeen rules on your .tex file: the statements the editorial office looks for, and the source that breaks the publisher's build. |
| Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened. |
| 22 rules that name the lines where a Node or TypeScript service writes personal data into logs, crash reports and analytics — with the article it touches and the one-line fix. |
| The 2026-07-28 MCP revision removed the initialize handshake, sessions, ping and 4 more RPCs. 27 rules find them in your mcp.json and server code, with the replacement on each line. |
| Reads .mcp.json / .vscode/mcp.json / claude_desktop_config.json while you edit it and marks the lines that hand an AI agent more than you meant - unpinned servers, literal credentials, plaintext trans |
| Lints a Hugging Face model card against the Hub metadata spec and the EU AI Act general-purpose AI documentation duties, line by line. |
| Finds the ad and analytics code that keeps firing after a visitor’s browser has already sent Global Privacy Control. |
| PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This read |
| Reads a migration, Prisma schema, Django model or TypeORM entity and marks every column a subject access request has to reach - with the GDPR article each finding hangs on. 13 rules, line numbers, no |
| Finds the lines that make Google Play reject your release - target API below 36, Billing Library below 8, 4 KB-only native libs - and prints the date each gate closed. |
| Dates every quantum-vulnerable algorithm in your code against the NIST IR 8547 clock: deprecated after 2030-12-31, disallowed after 2035-12-31. |
| Checks PrivacyInfo.xcprivacy and your C#, Dart, JS, Swift and Kotlin source for Apple required-reason APIs, and decodes all 17 reason codes back to the category they belong to. |
| 19 date-aware checks on the [project] metadata that decides whether your next release uploads |
| Checks robots.txt line by line and says what each AI crawler token actually controls - training, AI-search citation, or user fetch - and which lines silently do nothing. |
| Reads security headers and CSP line by line in your config file and names the lines that silently do nothing: retired headers, keywords missing their quotes, directives the browser throws away. |
| Names every column, index, view and seed row in a .sql migration that stores card data, with its PCI DSS Requirement 3 rule id |
| Finds the 12 settings that break when public TLS certificates fall to 100 days on 2027-03-15: openssl -days, Terraform, cert-manager, late expiry alerts, HPKP, TLS 1.0/1.1, SHA-1, RSA-1024. |
| Find the package.json lines that stop vsce before you run the release build |
| Audits HTML, JSX, Vue, Twig, Blade, ERB and Razor markup against the 24 WCAG 2.1 Level AA checks that 28 CFR 35.200 and EN 301 549 actually name - not WCAG 2.2. |
| Reads your stylesheet and names the success criterion each rule breaks, including the three WCAG 2.2 added that WCAG 2.1 linters never learned. |
| Finds the 12 author-side privacy duties your plugin PHP breaks, with the article and the fix on every line. |
Free vs licence
Free: checking the text or file you pass in, with every rule and every fix — no account, no telemetry. Licence key ($29 one-time per tool, or the yearly rule-update plan): the workspace sweep (check_dir / --dir), the exportable report and the CI exit code. Keys are verified against Polar; the free part never expires and never asks for the key.
Licence
LICENSE — source-available: read, audit and use freely (commercial use included); paid features require a valid licence key; the key check may not be removed or circumvented. Each package also ships a short LICENSE.txt with the same two rules.
Related
Free web versions of every tool + the licence store: https://getreadystack.com
VS Code / Open VSX extensions built from the same engines: https://github.com/jmshinhwa/readystack-themes
Available Tools
3 toolscheck_dirB
Kubernetes Removed API Lint - sweep a folder and return every finding (licence; the full run is free for 7 days)
| Name | Required | Description | Default |
|---|---|---|---|
| dir | Yes | ||
| ext | No | optional extension filter, e.g. .html |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It does disclose that the tool sweeps a folder and returns every finding, and it adds a licensing/trial caveat. Still, it does not clarify whether the operation is read-only, what a finding looks like, or any side effects or requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded and the sentence is shortvoice. However, the trailing licensing/free-trial content is not directly useful for selecting or invoking the tool and adds noise to an otherwise concise definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a relatively simple two-parameter tool, and the description gives enough to understand the basic action. Yet with no output schema and no discussion of return format, behavior on empty directories, or edge cases, the description is only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, with only ext documented. The description adds little parameter-level meaning beyond implying that 'dir' is the folder to sweep; it does not elaborate on directory traversal, extension filtering behavior, or examples for ext.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific operation: sweep a folder and return findings, scoped to Kubernetes Removed API lint. It is distinguishable from siblings like check_file and check_text by targeting folders, though it doesn't explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for folder-level linting, which helps distinguish it from sibling tools. However, it does not explicitly state when to use this tool instead of check_text or check_file, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_fileB
Kubernetes Removed API Lint - run all checks on one file by path (free)
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only says 'run all checks' and 'free' — it does not describe what the checks are, what output is produced, or whether there are side effects or limitations. This is thin coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the tool's domain and purpose. The parenthetical 'free' adds marginal value but does not significantly bloat the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no annotations and no output schema, the description provides the core trigger but omits important context such as what the checks involve and how results are returned. It is sufficient for rough selection but not for confident invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented 'path' parameter. It adds only that the path is for 'one file', without specifying format, constraints, or supported file types. Minimal added meaning beyond the schema field name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the domain ('Kubernetes Removed API Lint'), the action ('run all checks'), and the resource ('one file by path'). This makes the tool's function unambiguous and distinguishes it from siblings like check_text and check_dir.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys a clear use case: run all lint checks on a single file addressed by a path. It does not explicitly name alternatives or exclusions, but the 'one file by path' framing gives enough context to infer when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_textA
Kubernetes Removed API Lint - run all 15 checks on a text (free)
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | optional file name for context | |
| text | Yes | file contents |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description is the only behavioral source. It discloses that the tool runs all 15 checks and that it is free, but it does not state what is returned, whether the operation has side effects, or how the optional path is used. It is not misleading, but it leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact phrase that front-loads the domain, action, scope, and pricing. Every word contributes useful information with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only two parameters, high schema coverage, and no output schema. The description covers the operation but lacks any hint about the shape of the results or how the optional path affects execution, which an agent would benefit from knowing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents text and path. The description adds no additional meaning about either parameter, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('run all 15 checks') on a specific resource ('text') and scopes it to Kubernetes Removed API linting. The 'free' note adds practical context, and the contrast with sibling tools check_file/check_dir makes it clear this variant operates on inline text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use statement or named alternatives, but 'on a text' implies use when the content is inline rather than a file or directory. This is usable guidance, but the routing to this tool versus check_file/check_dir is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
check_dir - First observed
check_file - First observed
check_text
TDQS
Scored across 3 tools
Each tool targets a distinct input type (text, file, directory) for the same lint operation, leaving no ambiguity about which to use based on the data source.
All tools follow a consistent 'check_<input>' pattern, making the naming predictable and easy to learn.
Three tools is perfectly scoped for the server's purpose of running Kubernetes removed API lints on different input forms; each tool earns its place.
The tool set covers all common input scenarios (text, single file, directory) for the linting domain, and the fixed 15-check set means no missing functionality for the stated purpose.
Maintenance
Related MCP Connectors
EU compliance corpus across 8 frameworks (NIS2, DORA, AI Act, ISO 27001 + more) via MCP.
Open-source licence risk checks for AI coding agents and dependency trees.
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
Related MCP Servers
- AlicenseAqualityFmaintenanceQuery 37 EU regulations — from GDPR and AI Act to DORA, MiFID II, eIDAS, Medical Device Regulation, and more — directly from Claude, Cursor, or any MCP-compatible client.1475 npm25Apache 2.0
- AlicenseNot gradedqualityBmaintenanceLocal-first AI compliance scanner via Model Context Protocol, scanning codebases for violations of DPDPA 2023, RBI FREE-AI, SEBI AI/ML, and the EU AI Act.46 PyPI1Apache 2.0

Legalithmofficial
AlicenseAqualityAmaintenanceEU AI Act compliance in your editor.Classify risk, cite obligations, draft Article 50 disclosures. Offline, no API key.7MIT- AlicenseNot gradedqualityBmaintenanceEnables MCP-compatible AI agents to scan code for leaked secrets, copyleft licenses, unprotected routes, missing privacy policies, and risky card handling before committing or shipping.40 npmMIT