Skip to main content
Glama
jmshinhwa

ReadyStack Compliance Linters (40 MCP servers)

ReadyStack Compliance Linters — 40 MCP servers

Regulation- and deadline-aware linters (EU CRA / CSAF, PCI DSS 6.4.3, WCAG 2.1 AA, DORA, NIS2, EU AI Act, KSeF FA(3), NF-e, GitHub Actions EOL, TLS certificate lifetime, Kubernetes removed APIs …) that an AI agent calls over the Model Context Protocol (MCP).

Every folder in this repository is one npm package @readystack/<name>. The same package runs three ways: as a stdio MCP server (--mcp), as a CLI, and as a CI step. No network calls: every rule set ships inside the package and runs offline on the files you point it at.

Run as an MCP server (Claude Code · Cursor · Windsurf · any MCP client)

{ "mcpServers": { "k8s-removed-api-lint": { "command": "npx", "args": ["-y", "@readystack/k8s-removed-api-lint", "--mcp"] } } }

The server speaks MCP over stdio (JSON-RPC 2.0, protocol version 2025-06-18: initialize, tools/list, tools/call). Tools exposed by every server: check_dir · check_file · check_text. check_text and check_file are free with no account; check_dir (the workspace sweep with an exportable report and a CI exit code) needs a licence key from https://getreadystack.com — the full sweep is free for the first 7 days. Each finding comes back with the file, the line number and the fix.

Registry names: io.github.jmshinhwa/<name> in the official MCP Registry (registry.modelcontextprotocol.io).

Related MCP server: Meridian

Run as a CLI or in CI

npx -y @readystack/k8s-removed-api-lint --file deploy.yaml      # one file
npx -y @readystack/k8s-removed-api-lint --dir . --ci             # whole repo, non-zero exit on findings (licence)

Servers (40)

npm package

what it checks

@readystack/actions-deprecation-lint-2026

Node 20 is removed from GitHub-hosted runners on 2026-09-23 and ubuntu-22.04 deprecation opens 2026-09-17. This checks a workflow file against 25 dated GitHub shutdowns and names the date each line st

@readystack/ai-model-retirement-lint

Finds the LLM model IDs pinned in your code that vendors have already switched off, or have dated to switch off, with the replacement and the date.

@readystack/auditor-ibs-cbs-nfe

A rejeição por falta de IBS/CBS foi suspensa em 31/07/2026: sua NF-e é autorizada mesmo errada. Este auditor lê o XML no editor e aponta o que a SEFAZ deixou passar.

@readystack/autorenew-signup-lint

Sixteen statutory checks on the signup page AB 2863 rewrote, in your editor and in the browser

@readystack/base-image-eol-lint

Marks every base image in your Dockerfiles, compose files and CI workflows whose security patches have already stopped - or stop before 13 November 2026 - and prints the tag that replaces it.

@readystack/cloud-cost-landmine-lint

Names every line in the file you have open that starts a recurring cloud charge, with the published us-east-1 price and the date it changes by itself.

@readystack/cra-24-72-14-reporting-lint

Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT.

@readystack/cron-schedule-lint

Names every schedule line in the file you have open that fires at the wrong hour, twice, or never at all - and prints the next three times each one really fires, in the zone that actually applies.

@readystack/currency-minor-unit-lint

Finds the money lines that send the wrong amount to a payment API: the x100 that charges 100x in JPY, the toFixed(2) that truncates KWD, and the currency codes that stopped being legal tender.

@readystack/dora-ict-contract-clause-lint

Twenty-two checks over the ICT vendor contracts in your repository - every missing Article 30 clause named, with the wording to paste in.

@readystack/dora-register-lint

24 checks on the register CSV before it reaches the supervisor — LEI check digits, ISO dates and codes, references that resolve

@readystack/eaa-form-lint-wcag22

Names every WCAG 2.2 AA form failure on its line, with the criterion and the fix

@readystack/einvoice-mandate-lint

Lints UBL and CII invoice XML against EN 16931 and the national e-invoicing mandates that are live in 2026

@readystack/email-footer-law-lint

Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14.

@readystack/firmware-release-gate

Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA.

@readystack/france-einvoice-reception-lint

12 checks for the French mandatory mentions a PDP rejects, on Factur-X, UBL and CII invoices

@readystack/gpsr-listing-lint

Audits a product feed row by row against Article 19 of the EU General Product Safety Regulation

@readystack/jct-transition-lint-2026

2026年9月30日で80%控除が終わります。10月1日からは50%ではなく70%です(令和8年度税制改正)。請求・仕入コードに残った 0.8 と 0.5、明細ごとの端数処理、T+13桁でない登録番号を、行番号と修正案つきで指摘します。

@readystack/k8s-removed-api-lint

15 checks for the apiVersions kubectl no longer serves, on the manifest open in your editor

@readystack/latex-submission-lint

Seventeen rules on your .tex file: the statements the editorial office looks for, and the source that breaks the publisher's build.

@readystack/license-flip-audit

Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened.

@readystack/log-pii-telemetry-lint

22 rules that name the lines where a Node or TypeScript service writes personal data into logs, crash reports and analytics — with the article it touches and the one-line fix.

@readystack/mcp-2026-migration-lint

The 2026-07-28 MCP revision removed the initialize handshake, sessions, ping and 4 more RPCs. 27 rules find them in your mcp.json and server code, with the replacement on each line.

@readystack/mcp-config-guard

Reads .mcp.json / .vscode/mcp.json / claude_desktop_config.json while you edit it and marks the lines that hand an AI agent more than you meant - unpinned servers, literal credentials, plaintext trans

@readystack/model-card-lint-gpai

Lints a Hugging Face model card against the Hub metadata spec and the EU AI Act general-purpose AI documentation duties, line by line.

@readystack/optout-signal-lint

Finds the ad and analytics code that keeps firing after a visitor’s browser has already sent Global Privacy Control.

@readystack/pci-payment-page-script-audit

PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This read

@readystack/personal-data-map-dsar-audit

Reads a migration, Prisma schema, Django model or TypeORM entity and marks every column a subject access request has to reach - with the GDPR article each finding hangs on. 13 rules, line numbers, no

@readystack/play-release-blocker-lint

Finds the lines that make Google Play reject your release - target API below 36, Billing Library below 8, 4 KB-only native libs - and prints the date each gate closed.

@readystack/pqc-deprecation-lint

Dates every quantum-vulnerable algorithm in your code against the NIST IR 8547 clock: deprecated after 2030-12-31, disallowed after 2035-12-31.

@readystack/privacy-manifest-lint

Checks PrivacyInfo.xcprivacy and your C#, Dart, JS, Swift and Kotlin source for Apple required-reason APIs, and decodes all 17 reason codes back to the category they belong to.

@readystack/pyproject-release-gate

19 date-aware checks on the [project] metadata that decides whether your next release uploads

@readystack/robots-txt-ai-crawler-audit

Checks robots.txt line by line and says what each AI crawler token actually controls - training, AI-search citation, or user fetch - and which lines silently do nothing.

@readystack/security-headers-csp-lint

Reads security headers and CSP line by line in your config file and names the lines that silently do nothing: retired headers, keywords missing their quotes, directives the browser throws away.

@readystack/sql-card-data-lint

Names every column, index, view and seed row in a .sql migration that stores card data, with its PCI DSS Requirement 3 rule id

@readystack/tls-cert-lifetime-lint

Finds the 12 settings that break when public TLS certificates fall to 100 days on 2027-03-15: openssl -days, Terraform, cert-manager, late expiry alerts, HPKP, TLS 1.0/1.1, SHA-1, RSA-1024.

@readystack/vsix-publish-lint

Find the package.json lines that stop vsce before you run the release build

@readystack/wcag21-aa-legal-baseline-audit

Audits HTML, JSX, Vue, Twig, Blade, ERB and Razor markup against the 24 WCAG 2.1 Level AA checks that 28 CFR 35.200 and EN 301 549 actually name - not WCAG 2.2.

@readystack/wcag22-css-lint

Reads your stylesheet and names the success criterion each rule breaks, including the three WCAG 2.2 added that WCAG 2.1 linters never learned.

@readystack/wordpress-privacy-lint

Finds the 12 author-side privacy duties your plugin PHP breaks, with the article and the fix on every line.

Free vs licence

Free: checking the text or file you pass in, with every rule and every fix — no account, no telemetry. Licence key ($29 one-time per tool, or the yearly rule-update plan): the workspace sweep (check_dir / --dir), the exportable report and the CI exit code. Keys are verified against Polar; the free part never expires and never asks for the key.

Licence

LICENSE — source-available: read, audit and use freely (commercial use included); paid features require a valid licence key; the key check may not be removed or circumvented. Each package also ships a short LICENSE.txt with the same two rules.

Available Tools

3 tools
check_dirB

Kubernetes Removed API Lint - sweep a folder and return every finding (licence; the full run is free for 7 days)

ParametersJSON Schema
NameRequiredDescriptionDefault
dirYes
extNooptional extension filter, e.g. .html

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It does disclose that the tool sweeps a folder and returns every finding, and it adds a licensing/trial caveat. Still, it does not clarify whether the operation is read-only, what a finding looks like, or any side effects or requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded and the sentence is shortvoice. However, the trailing licensing/free-trial content is not directly useful for selecting or invoking the tool and adds noise to an otherwise concise definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a relatively simple two-parameter tool, and the description gives enough to understand the basic action. Yet with no output schema and no discussion of return format, behavior on empty directories, or edge cases, the description is only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, with only ext documented. The description adds little parameter-level meaning beyond implying that 'dir' is the folder to sweep; it does not elaborate on directory traversal, extension filtering behavior, or examples for ext.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific operation: sweep a folder and return findings, scoped to Kubernetes Removed API lint. It is distinguishable from siblings like check_file and check_text by targeting folders, though it doesn't explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for folder-level linting, which helps distinguish it from sibling tools. However, it does not explicitly state when to use this tool instead of check_text or check_file, nor does it mention any exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_fileB

Kubernetes Removed API Lint - run all checks on one file by path (free)

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only says 'run all checks' and 'free' — it does not describe what the checks are, what output is produced, or whether there are side effects or limitations. This is thin coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the tool's domain and purpose. The parenthetical 'free' adds marginal value but does not significantly bloat the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no annotations and no output schema, the description provides the core trigger but omits important context such as what the checks involve and how results are returned. It is sufficient for rough selection but not for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the undocumented 'path' parameter. It adds only that the path is for 'one file', without specifying format, constraints, or supported file types. Minimal added meaning beyond the schema field name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the domain ('Kubernetes Removed API Lint'), the action ('run all checks'), and the resource ('one file by path'). This makes the tool's function unambiguous and distinguishes it from siblings like check_text and check_dir.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys a clear use case: run all lint checks on a single file addressed by a path. It does not explicitly name alternatives or exclusions, but the 'one file by path' framing gives enough context to infer when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_textA

Kubernetes Removed API Lint - run all 15 checks on a text (free)

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNooptional file name for context
textYesfile contents

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description is the only behavioral source. It discloses that the tool runs all 15 checks and that it is free, but it does not state what is returned, whether the operation has side effects, or how the optional path is used. It is not misleading, but it leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact phrase that front-loads the domain, action, scope, and pricing. Every word contributes useful information with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only two parameters, high schema coverage, and no output schema. The description covers the operation but lacks any hint about the shape of the results or how the optional path affects execution, which an agent would benefit from knowing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents text and path. The description adds no additional meaning about either parameter, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('run all 15 checks') on a specific resource ('text') and scopes it to Kubernetes Removed API linting. The 'free' note adds practical context, and the contrast with sibling tools check_file/check_dir makes it clear this variant operates on inline text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use statement or named alternatives, but 'on a text' implies use when the content is inline rather than a file or directory. This is usable guidance, but the routing to this tool versus check_file/check_dir is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedcheck_dir
    • First observedcheck_file
    • First observedcheck_text

TDQS

A3.8/5.0

Scored across 3 tools

Disambiguation5/5

Each tool targets a distinct input type (text, file, directory) for the same lint operation, leaving no ambiguity about which to use based on the data source.

Naming Consistency5/5

All tools follow a consistent 'check_<input>' pattern, making the naming predictable and easy to learn.

Tool Count5/5

Three tools is perfectly scoped for the server's purpose of running Kubernetes removed API lints on different input forms; each tool earns its place.

Completeness5/5

The tool set covers all common input scenarios (text, single file, directory) for the linting domain, and the fixed 15-check set means no missing functionality for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    F
    maintenance
    Query 37 EU regulations — from GDPR and AI Act to DORA, MiFID II, eIDAS, Medical Device Regulation, and more — directly from Claude, Cursor, or any MCP-compatible client.
    14
    75 npm
    25
    Apache 2.0
  • A
    license
    Not graded
    quality
    B
    maintenance
    Local-first AI compliance scanner via Model Context Protocol, scanning codebases for violations of DPDPA 2023, RBI FREE-AI, SEBI AI/ML, and the EU AI Act.
    46 PyPI
    1
    Apache 2.0
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP-compatible AI agents to scan code for leaked secrets, copyleft licenses, unprotected routes, missing privacy policies, and risky card handling before committing or shipping.
    40 npm
    MIT