Korean Privacy Law MCP

An MCP for searching, comparing, analyzing, and verifying the Republic of Korea's Personal Information Protection Act (PIPA) using natural language.

With 31 Ministry of Government Legislation tools + 2 official PIPC source indices + 3 RAG corpora + 1 hallucination verification tool — a total of 37 MCP tools handle PIPA, enforcement decrees, PIPC notifications, resolutions, 4 types of official PIPC guides, and 1,745 consultation cases (2,202 chunks in total) to help you solve problems related to privacy law.

Let's solve privacy law issues by talking with AI.

Korean

Why I Created This

Large corporations and public institutions have internal legal teams or CPOs to manage privacy protection.

However, small and medium-sized enterprises, small business owners, and pharmacies are often left in a blind spot due to a lack of personnel and budget to overcome the invisible barrier of the law.

I hope this MCP will be of some help to those who find it difficult to access the Personal Information Protection Act.

Related MCP server: lawink-mcp

v0.8 — Privacy Law, Related Statutes, Guides, and Consultation Cases All at Once

Built on top of 31 Ministry of Government Legislation OPEN API wrappers, a total of 37 tools—including 2 official PIPC source indices + 3 RAG corpora for guides/consultation cases + 1 four-layer hallucination verification—search, compare, and analyze Korean legal information and official PIPC materials in natural language.

Key Developments

• Official PIPC RAG Corpus (2,202 chunks) — Practical materials not available in the Ministry of Government Legislation API. 457 chunks from 4 types of guides (99 Q&A + 41 small business + 71 CCTV + 246 sectoral guides) + 1,745 consultation cases from the Personal Information Portal. Anthropic Contextual Retrieval applied. BM25 index memory build at boot (Korean tokenizer, prefix + fuzzy 0.2).

• Official PIPC Source Indexing (Curation 0) — Structured tables from the "Sectoral Personal Information Protection Guide" (PIPC, 2024.12) + 12 statutes and 23 administrative rules from the Personal Information Portal (privacy.go.kr/contsNo=116·117). No opinions or mapping of our own — strictly PIPC official tables and portal lists. Every response automatically includes source, page, publication date, and a "mandatory additional review" disclaimer.

• 4-Layer Delegation Tracking — Combines get_three_tier (Act-Enforcement Decree-Enforcement Rule) + get_delegated_laws + administrative rule search to trace the delegation path from PIPA articles to PIPC notifications in a single natural language line.

• Time-based Branching — Uses get_historical_law, get_article_change_history, and get_law_history to verify the absorption of the Information and Communications Network Act into PIPA, text before/after amendments, and citations of old articles.

• PIPC Resolution Search & Cascading Summarization — Summarizes 10,000+ character resolution texts into the first 800 characters + [omitted] + last 400 characters. Handles case-sensitive response quirks (<Ppc> vs <ppc>).

• 4-Layer Hallucination Verification — verify_pipa_citation verifies citations in the order of Statute Name → Article → Paragraph → Subparagraph/Item. If a hallucination is detected, it returns [HALLUCINATION_DETECTED] + step-by-step ✗ + guidance on the next tool. Verifies text at specific points in time using as_of YYYYMMDD (e.g., whether §22 of the Information and Communications Network Act was valid at that time).

• Response Baseline Standardization — 4 machine-parsing markers: [NOT_FOUND], [HALLUCINATION_DETECTED], [OUT_OF_SCOPE], [NOT_FOUND_SCOPE] + regular URL (📎 Source: ...) + automatic attachment of next tool candidates (allowing LLMs to continue naturally without chains).

• Automatic Recognition of 17 Legal Abbreviations — Including PIPA, Privacy Act, Network Act, Credit Information Act, Location Information Act, Communication Privacy Act, Information Disclosure Act, Electronic Government Act, etc. Since the Ministry of Government Legislation's lsAbrv dictionary rarely includes domain abbreviations, PRIVACY_ALIASES provides the supplement.

Example — Reaching Domain Depth in One Natural Language Line

"의료기관에서 환자 개인정보 처리할 때 어떤 법이 우선이야?"

→ When the AI receives a natural language query, it automatically performs the following:

• get_sectoral_related_laws("Medical Institutions") — PIPC sectoral guide official table lookup

• Separate output for official_laws (PIPC official classification) + additional_mentions (text frequency statistics)

• Direct citation of PIPC based on the lex specialis principle + automatic attachment of source, page, publication date, and "mandatory additional review" disclaimer

Result Example:

"The 'Personal Information Protection Act' is a general law, while the Medical Service Act is a special law (lex specialis) regarding patient personal information. The PIPC also specified this in the FAQ of the 'Sectoral Personal Information Protection Guide (2024.12)' for medical institutions — if there is a provision in the 'Medical Service Act', it applies; if not, the 'Personal Information Protection Act' applies."

"개인정보 보호법 §28-2 가명정보 처리 조항이 2020년 6월 시점에 유효했어?"

→ When the AI receives a natural language query, it automatically performs the following:

• Calls verify_pipa_citation(citation="Personal Information Protection Act §28-2", as_of="20200601")

• Verifies step-by-step across 4 layers (Statute → Article → Paragraph → Subparagraph/Item) by looking up text at specific points in time via efYd

• If successful, returns ✅ + 4-layer ✓ + mst·lawId + regular URL / If hallucination, returns [HALLUCINATION_DETECTED] + step-by-step ✗

Result Example:

Conclusion: No. As of June 2020, it was not yet in effect. It was part of the amendment of the so-called 'Data 3 Laws' (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act), which was promulgated on February 4, 2020, and took effect on August 5 after a 6-month grace period. Therefore, it was not possible to use §28-2 as a basis for processing pseudonymized information in June 2020, and at that time, there was no general law provision directly regulating the concept of pseudonymized information (new legal grounds for pseudonymization and combination for statistical compilation, scientific research, and public interest archiving all began after August 5).

PIPA domain tracking + citation verification in one natural language line.

Installation and Usage

Step 0: Get API Key (Free, 1 minute)

First, obtain the Ministry of Government Legislation OPEN API Authentication Key (OC), which is required for all methods.

1. Visit the Ministry of Government Legislation OPEN API Application Page

2. Sign up and log in

3. Click the "Apply for OPEN API Usage" button

4. Fill out the application → Receive Authentication Key (OC) (email ID format)

your-api-key-here in all examples below is a placeholder — replace it with your own key. (Same convention as .env.example)

Method 1: Use directly in Claude.ai web (No installation) - Easiest

Add a custom connector in claude.ai. Requires Claude Pro/Max/Team/Enterprise plan (Free plan only allows 1 connector).

How to add a connector:

1. Log in to claude.ai

2. Click your name at the bottom of the sidebar → "Settings" → "Connectors"

3. "Custom Connectors" area → "Add Custom Connector"

4. Enter the following (replace your-api-key-here with your key):

   • Name: korean-privacy-law (optional)

   • URL: https://scvcoder-korean-privacy-law-mcp.hf.space/mcp?oc=your-api-key-here

5. "Add" → Registration complete

Enable Tools (Important): Click "Configure" on the registered connector → Set all tools to "Always allow" in the tool list. This allows the AI to call them immediately without approval every time.

Now, in chat, use natural language:

"개인정보 보호법 제15조 알려줘"                                → 법령 조문 본문
"의료기관 환자 개인정보 처리할 때 어떤 법이 우선이야?"          → PIPC 분야별 매핑
"가족 동의 없이 자녀 사진 SNS 에 올리면?"                       → 상담사례 검색
"개인정보 보호법 §28-2 가 2020년 6월 시점에 유효했어?"           → 인용 조문 시점 검증
"PIPC 가 동의 없는 마케팅 문자 발송에 어떻게 의결했어?"          → PIPC 의결례

The Hugging Face remote server is a best-effort service provided for free by the operator (scvcoder) — no operation guarantee. If you want to deploy it yourself for your own operation, refer to docs/HUGGINGFACE.md (Pro subscription + 5 minutes required).

Method 2: Use in AI Desktop Apps (Claude Desktop · Cursor · Windsurf)

Add the following to your configuration file (replace your-api-key-here with your key):

{
  "mcpServers": {
    "korean-privacy-law": {
      "url": "https://scvcoder-korean-privacy-law-mcp.hf.space/mcp?oc=your-api-key-here"
    }
  }
}

Configuration File Location:

If other MCP servers are already configured, just add the "korean-privacy-law": { ... } part inside "mcpServers": { ... }. Save and restart the app.

Method 3: Install directly on your computer (Offline possible)

If you want to use it without the internet or avoid remote servers, you can install it directly.

Prerequisites: Node.js version 18 or higher.

Automatic Execution (npx, recommended):

Add the following to your configuration file:

{
  "mcpServers": {
    "korean-privacy-law": {
      "command": "npx",
      "args": ["-y", "korean-privacy-law-mcp"],
      "env": {
        "LAW_OC": "your-api-key-here"
      }
    }
  }
}

Checks npm cache every time — new versions applied automatically.

Global Installation (Faster boot):

npm install -g korean-privacy-law-mcp

Change the configuration file to the following:

{
  "mcpServers": {
    "korean-privacy-law": {
      "command": "korean-privacy-law-mcp",
      "env": {
        "LAW_OC": "your-api-key-here"
      }
    }
  }
}

Boot is 0.5~1 second faster. Manually update new versions with npm install -g korean-privacy-law-mcp.

Build directly from source (Developer):

git clone https://github.com/scvcoder/korean-privacy-law-mcp.git
cd korean-privacy-law-mcp
npm install
npm run build

Specify the absolute path in the configuration file:

{
  "mcpServers": {
    "korean-privacy-law": {
      "command": "node",
      "args": ["/절대경로/korean-privacy-law-mcp/dist/index.js"],
      "env": {
        "LAW_OC": "your-api-key-here"
      }
    }
  }
}

Alternatively, if you create a .env file in the project root with LAW_OC=..., it will be loaded automatically — the env block can be omitted.

Detailed step-by-step for Claude Desktop + troubleshooting: docs/CLAUDE_DESKTOP.md

Restart the app and you're done!

Summary of API Key Delivery Methods

There are several ways to provide the authentication key. They are applied in the following order of priority:

Usage Examples

Search Statutes, Administrative Rules, Resolutions, and Interpretations

Find statute texts, delegation relationships up to enforcement decrees/rules and PIPC notifications, as well as PIPC resolutions, Constitutional Court decisions, and interpretations in natural language.

"개인정보 보호법 제15조 알려줘"
→ 해당 조문 본문과 법제처 정식 출처 링크를 함께 반환합니다.

"개인정보 영향평가 의무는 어떤 법령에 어디까지 정해져 있어?"
→ 법·시행령·시행규칙·PIPC 고시까지의 위임 경로를 한 번에 정리해 줍니다.

"PIPC 가 동의 없는 마케팅 문자 발송에 어떻게 의결했어?"
→ 관련 의결례를 찾아 핵심 부분을 발췌해 보여 줍니다."

PIPC Official Sectoral Mapping

Which law takes precedence in a specific sector — receive official answers posted directly by the PIPC along with sources. These are not processed or interpreted by us, but are the original tables from the PIPC.

"병원에서 환자 정보 처리할 때 의료법이랑 개인정보 보호법 중 뭐가 우선이야?"
→ PIPC 「분야별 개인정보 보호 안내서」 의 의료기관 편 답변을 그대로 보여 줍니다.

"개인정보 포털에 등록된 관련 법령·행정규칙 목록 알려줘"
→ privacy.go.kr 에 PIPC 가 직접 등록한 12 법령 + 23 행정규칙 list 를 반환합니다.

Supported sectors: HR/Labor · Social Welfare Facilities · Medical Institutions · Pharmacies · Academies/Tutoring Centers · Statistical Compilation · Public Institutions · Online Prizes. (Aliases like Hospital → Medical Institution are automatically recognized)

Natural Language Search for PIPC Guides & Consultation Cases

Search 4 types of official guides published by the PIPC + 1,745 consultation cases from the Personal Information Portal in natural language. All answers include official PIPC sources for verification.

"가족 동의 없이 자녀 사진을 SNS 에 올려도 돼?"
→ 개인정보 포털의 관련 상담사례를 찾아 답변을 보여 줍니다.

"가명정보를 다른 회사 데이터와 결합하려면?"
→ 「개인정보 질의응답 모음집」 에서 해당 항목을 찾아 답변을 보여 줍니다.

"약국에서 처방전 보관할 때 주의할 점"
→ 가이드 4종 + 상담사례를 통합 검색해 가장 관련성 높은 항목을 보여 줍니다.

Verify if Cited Articles Exist / Were Valid at the Time

Check if the legal articles cited by the AI in its response actually exist or were valid at a specific point in the past. A safety mechanism to catch hallucinations (articles made up by AI).

"개인정보 보호법 §15 ② 1호가 실제로 있는 조문인지 확인해 줘"
→ 법령·조·항·호·목 단계별로 존재 여부를 검증합니다.

"개인정보 보호법 §28-2 가 2020년 6월 시점에 유효했어?"
→ 그 시점 기준으로 조문이 시행 중이었는지 시점별 본문으로 검증합니다.

Statute names are recognized even if entered as abbreviations (Privacy Act, Network Act, Credit Information Act, Location Information Act, Communication Privacy Act, etc.).

Tool Structure (37 items)

Refer to docs/API.md for full tool details (names, parameters, examples).

Key Features

• 37 Integrated Tools — 31 Ministry of Government Legislation + 2 official PIPC source indices + 3 RAG corpora + 1 4-layer hallucination verification.

• Statutes + Related Statutes + Guides + Consultation Cases — Combines guides and consultation cases that general legal MCPs cannot handle into RAG corpora, processing them all at once within one MCP.

• Official PIPC RAG Corpus (2,202 chunks) — 4 types of guides (Q&A, Small Business Handbook, CCTV Guide, Sectoral Guide) + 1,745 consultation cases from the Personal Information Portal. Contextual Retrieval applied.

• 100% Indexing of Official PIPC Sources — 0 curation by us. Sectoral guides, laws/administrative rules registered on the Personal Information Portal are kept exactly as in the PIPC posted tables.

• Natural Language Sector Matching — Automatic normalization of aliases (Hospital → Medical Institution, Audit → Public Institution, etc., 8 sectors total).

• Legal Domain Specialization — Automatic recognition of 17 abbreviations (PIPA, Privacy Act, Network Act, Credit Information Act, Location Information Act, etc.), article number normalization (§28-2 ↔ 002802), 4-layer delegation tracking (Act-Decree-Rule-PIPC Notification).

• 4-Layer Hallucination Verification — Verifies step-by-step whether cited articles actually exist (Statute → Article → Paragraph → Subparagraph/Item). Catches old article citations via time-based (as_of) verification.

• Remote + Local Mode — Use immediately via https://scvcoder-korean-privacy-law-mcp.hf.space OR local stdio via npx korean-privacy-law-mcp.

• Single MCP Standard — Same 37 tools everywhere: Claude.ai web, Claude Desktop, Cursor, Windsurf.

• Verification — 441 cases automatically tested (npm test — actual Ministry of Government Legislation API calls + snapshots, not mock-heavy).

• License — MIT (code).

RAG Source Material — Personal Information Protection Commission guides and Personal Information Portal consultation cases (https://www.privacy.go.kr/front/case/list.do).

※ If the copyright holder of the original material requests deletion or modification of all or part, we will take immediate action.

Environment Variables

If you place a .env file in the project root, it will be loaded automatically. Even if spawned with an arbitrary cwd like Claude Desktop, it automatically searches for ../.env based on the script directory. If it still can't find it, it only outputs a warning to stderr (the server starts — some operations like Layer C RAG search can work without a key).

Full variables + examples: .env.example.

Documentation

License and RAG Source Material

MIT (code)

RAG Source Material — Personal Information Protection Commission guides and Personal Information Portal consultation cases (https://www.privacy.go.kr/front/case/list.do).

※ If the copyright holder of the original material requests deletion or modification of all or part, we will take immediate action.

This MCP is not legal advice. It is a tool to assist in searching, comparing, and analyzing personal information domain materials; please seek professional advice or consultation from specialized institutions for legal judgments on specific matters.

Made by scvcoder