Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@io.github.mister-franklin/gdpr-decisions largest GDPR fines in 2024"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Remote MCP server providing AI-powered access to the largest EU GDPR enforcement decisions database. Search decisions, recommendations, and guidelines from all EU/EEA Data Protection Authorities, CJEU judgments, and EDPB guidelines.
Built by Mr. Franklin for The DPO.
Semantic search across thousands of GDPR enforcement decisions using legal-domain embeddings (Voyage voyage-law-2)
Hybrid search combining vector similarity, full-text search, and legal source hierarchy weighting
Reranking with Voyage rerank-2.5 for optimal result relevance
GDPR article lookup — find decisions by violated or cited GDPR article
Enforcement statistics — aggregate data on fines, violations, and authority activity
Full decision details including sanctions, controller data, and GDPR article references
Related MCP server: GDPR Compliance for AI Systems MCP Server
Tool | Description |
| Semantic search with optional jurisdiction filter |
| Full decision details by ID |
| Find decisions by GDPR article number |
| Aggregate enforcement statistics |
Sign up at thedpo.eu/mcp to get your API key. Free tier includes 3 advice sessions per month.
Add to your Claude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"gdpr-decisions": {
"command": "uvx",
"args": ["mcp-server-gdpr-decisions"],
"env": {
"GDPR_API_KEY": "sk_free_your_key_here"
}
}
}
}Ask Claude questions like:
"What are the largest GDPR fines in 2024?"
"Find decisions about consent for cookies"
"Which DPA decisions cite Article 6 GDPR?"
"Give me enforcement statistics for Belgium"
Tier | Sessions/month | Price |
Free | 3 | Free |
Pro | Unlimited | See thedpo.eu/mcp |
A session is a 15-minute window. Follow-up questions within the same session don't count as new sessions.
MIT
Get full details of a specific GDPR decision by its ID. Returns the complete summary, violated articles, sanctions, controller info, and legal analysis. Use after search_gdpr_decisions to get more detail on a specific result.
| Name | Required | Description | Default |
|---|---|---|---|
| decision_id | Yes | UUID of the decision (from search results) | |
| api_key | No | Your API key from https://thedpo.eu/mcp |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so description must cover behavior. It lists return fields but does not mention read-only nature, authentication requirements (beyond API key), rate limits, or side effects. Minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each serving a purpose: defining the tool and providing usage context. No redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with no output schema, the description covers the essential return fields and usage pattern. Could mention optional API key requirement more explicitly, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters with descriptions (100% coverage). Description adds context that decision_id comes from search results, but otherwise adds no new semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves full details of a GDPR decision by ID, listing specific fields returned (summary, articles, sanctions, etc.). It distinguishes from siblings by recommending use after search_gdpr_decisions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after search_gdpr_decisions for more detail, providing clear context. No when-not-to-use or alternative tools mentioned, but the guidance is helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get aggregate GDPR enforcement statistics: total decisions, total fines, average fine, decisions this month, authorities covered. Useful for contextualizing advice with enforcement trends.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | Your API key from https://thedpo.eu/mcp |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must convey behavioral traits. It indicates read-only aggregate statistics but does not mention idempotency, latency, or authorization requirements beyond the implied API key. The description does not clarify that the api_key parameter is required (the schema shows 0 required parameters, creating ambiguity).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that lists key statistics, which is efficient and front-loaded. No unnecessary words, but it could be slightly more structured for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description partially compensates by listing example metrics but does not specify the return format (e.g., JSON structure). It also does not explain how the api_key parameter is used. This leaves some ambiguity for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter (api_key) described in the schema. The description does not add any additional meaning beyond the schema's parameter description, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get aggregate GDPR enforcement statistics' and lists specific metrics (total decisions, total fines, average fine, etc.). It distinguishes from siblings like get_decision_detail by focusing on aggregate data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says 'Useful for contextualizing advice with enforcement trends,' which implies when to use it. However, it does not explicitly mention when not to use it or contrast with siblings, though sibling names provide some context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Find GDPR decisions that cite or violate a specific GDPR article. Useful for finding enforcement patterns for specific provisions. Examples: '5(1)(a)' for lawfulness/fairness/transparency, '6(1)' for legal basis, '32' for security measures.
| Name | Required | Description | Default |
|---|---|---|---|
| article | Yes | GDPR article reference, e.g. '5(1)(a)', '6(1)', '13', '32'. Use the format as it appears in the GDPR text. | |
| violated_only | No | If true (default), only returns decisions where the article was violated. If false, includes all citations. | |
| country | No | Filter by country (ISO 3166-1 alpha-2) | |
| limit | No | Max results (default 15, max 30) | |
| api_key | No | Your API key from https://thedpo.eu/mcp |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that results can be filtered by violation status, country, and limit, but does not describe return format, pagination, rate limits, or authentication requirements beyond the api_key parameter. Basic behavioral traits are covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (two sentences and examples) with no wasted words. Every sentence provides actionable information, and examples are front-loaded for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately covers the tool's scope (article, violation filter, geography, limit). It lacks details on return structure or error handling, but for a search tool with these parameters, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has 100% coverage of parameter descriptions. The description adds marginal value by providing example article formats and clarifying the default for 'violated_only,' but does not significantly enhance meaning beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: finding GDPR decisions that cite or violate a specific GDPR article. It uses specific verbs ('find,' 'cites or violates') and provides concrete examples of article references, which distinguishes it from sibling tools like 'get_decision_detail' or 'search_gdpr_decisions'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells when to use the tool ('useful for finding enforcement patterns for specific provisions') and implies its specialized nature compared to broader search tools. However, it does not explicitly state when not to use it or mention alternatives like 'search_gdpr_decisions' for broader queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search the EU GDPR case law database using semantic search. Finds relevant decisions from all EU/EEA Data Protection Authorities (GBA, CNIL, AP, etc.), CJEU judgments, and EDPB guidelines. Returns decisions with summaries, fines, violated articles, and metadata. Use this to find case law supporting legal advice.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Natural language search query describing the legal question or topic. Examples: 'legitimate interest for direct marketing', 'consent requirements for cookies', 'data breach notification obligations' | |
| jurisdiction | No | ISO 3166-1 alpha-2 country code to prioritize (e.g. 'BE', 'NL', 'FR', 'DE'). When set, decisions from this jurisdiction are ranked higher. Use 'EU' for CJEU/EDPB sources. | |
| limit | No | Max results to return (default 8, max 20) | |
| api_key | No | Your API key from https://thedpo.eu/mcp |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It states the tool performs semantic search and returns decisions with summaries, fines, etc. However, it does not disclose authentication requirements (api_key param), rate limits, or that it is read-only. The description is adequate but lacks behavioral details beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the primary action. Each sentence adds unique value: semantic search, sources listed, return contents, and usage guidance. Efficient and well-structured, though could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a semantic search tool across multiple jurisdictions, the description covers key aspects: what it searches, what it returns, and a usage hint. No output schema, but return types are summarized. Missing pagination details beyond limit param, but overall sufficiently complete for an AI agent to understand the tool's purpose and basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description adds example queries for the 'query' parameter and explains jurisdiction and limit values, but these largely mirror schema descriptions. No significant additional meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it performs semantic search on EU GDPR case law, listing sources (DPAs, CJEU, EDPB) and explicitly says 'Use this to find case law supporting legal advice.' This distinguishes it from sibling tools like get_decision_detail (for single decision details) and search_by_gdpr_article (specific article search).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description provides a general use case ('find case law supporting legal advice') but does not explicitly state when not to use this tool or mention alternatives like search_by_gdpr_article for article-specific searches. Guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0get_decision_detailget_gdpr_statisticssearch_by_gdpr_articlesearch_gdpr_decisionsScored across 4 tools
Each tool has a distinct and clear purpose: search_gdpr_decisions for general semantic search, search_by_gdpr_article for article-specific search, get_decision_detail for fetching details, and get_gdpr_statistics for aggregate stats. There is no overlap or ambiguity.
All tool names use consistent snake_case with a verb_noun pattern ('search_' and 'get_'). The naming is predictable and follows a clear convention.
Four tools is an appropriate scope for the server's purpose. It covers the essential operations (search, detail, statistics) without being too sparse or excessive.
The tool set covers core workflows: searching generally and by article, retrieving details, and statistics. A minor gap is the lack of explicit listing or filtering options beyond article search, but the semantic search likely handles many use cases.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
EU law, article-level: GDPR, NIS2, DORA, EU AI Act + more, with EUR-Lex citations. Keyless.
Experimental GDPR grounding: rules, preconditions, exceptions, exact quotes, and citation checks.
EU regulations (GDPR, DORA, NIS2, AI Act, etc.) via Ansvar Gateway. Cited, OAuth + paid.
EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.
