Skip to main content
Glama
Ansvar-Systems

Italian Data Protection MCP

Italian Data Protection MCP

▶ Try this MCP instantly via Ansvar Gateway

50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway

One endpoint, one OAuth signup, access from any MCP-compatible client.

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Italian data protection data for AI compliance tools.

License CI

Query Italian data protection data -- regulations, decisions, and requirements from Garante per la protezione dei dati personali -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: io.github.mister-franklin/gdpr-decisions

Available Tools (6)

Tool

Description

it_dp_search_decisions

Full-text search across Garante decisions (provvedimenti, sanzioni, ordinanze). Returns matching decisions with refer...

it_dp_get_decision

Get a specific Garante decision by reference number (e.g.,

it_dp_search_guidelines

Search Garante guidance documents: linee guida, provvedimenti generali, and FAQ. Covers GDPR implementation, cookie e...

it_dp_get_guideline

Get a specific Garante guidance document by its database ID.

it_dp_list_topics

List all covered data protection topics with Italian and English names. Use topic IDs to filter decisions and guideli...

it_dp_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Italian regulatory publications:

  • Garante per la protezione dei dati personali -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by Garante per la protezione dei dati personali. However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/italian-data-protection-mcp
cd italian-data-protection-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet at ansvar.eu/gateway.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
it_dp_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the operation is a read ('Return metadata') and names the returned fields, which is valuable given there is no output schema. It does not cover auth requirements or rate limits, but for a static introspection endpoint those are minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with the verb and resource, with the enumerated contents following in a compact list. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parameters, no output schema, and no annotations, the description supplies everything needed: it identifies the resource and enumerates the return fields. Nothing an agent needs in order to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the baseline this scores 4. There is no parameter semantics to document and the description correctly avoids describing any.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return metadata about this MCP server') and enumerates the exact content of the response (version, data source, coverage, tool list). This is unambiguously distinct from the sibling search/get/list data-access tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose implies usage (discovering server info / available tools), but the description never says when to call it or when not to. For a zero-parameter introspection tool usage is largely self-evident, so implied guidance is adequate but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

it_dp_get_decisionA

Get a specific Garante decision by reference number (e.g., 'GPDP-2021-001', 'GARANTE-2022-CL').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesGarante decision reference number

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden — and it discloses almost nothing behavioral. It does not say whether the call fails or returns empty on an unknown reference, whether access is restricted, or what kind of content comes back. 'Get' implies a safe read, but that is left to inference.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the action and resource, with the identifier convention appended as examples. Nothing is wasted and nothing needs to be re-read.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description should say more about the result (what a 'decision' comprises) and the failure mode for a bad reference. For a single-parameter read tool the gap is modest, but an agent still lacks enough to handle the not-found case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds real value on top by supplying concrete reference-number formats ('GPDP-2021-001', 'GARANTE-2022-CL'), which helps the agent construct a valid value rather than just knowing the field exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Get a specific Garante decision') and the exact key used to identify it ('by reference number'). The 'get by reference' framing inherently contrasts with the sibling search tool (it_dp_search_decisions), so an agent can route correctly without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the phrasing: call this when you already hold a reference number rather than when you need to discover one. However, the description never explicitly routes to it_dp_search_decisions for lookup, nor says what to do when the reference is unknown or invalid.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

it_dp_get_guidelineB

Get a specific Garante guidance document by its database ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesGuideline database ID (from it_dp_search_guidelines results)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states only what the tool does, with no information about permissions, error behavior for missing IDs, rate limits, or what the returned document includes, leaving the agent to infer read-only behavior from the verb 'Get'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundant or filler content. Every word earns its place and conveys the essential operation efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter retrieval tool with full schema coverage and no output schema, the description is minimally adequate. It does not explain the return format or outline when to use it over sibling search tools, but the structured fields cover the invocation mechanics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single parameter is fully documented as coming from search results. The tool description adds no parameter semantics beyond restating that retrieval is by database ID, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Get') and resource ('Garante guidance document') with a clear retrieval method ('by its database ID'). It distinguishes itself from search-oriented siblings implicitly by requiring an ID, but it does not explicitly name an alternative or contrast with them, which keeps it from a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no explicit guidance on when to use this tool versus alternatives such as it_dp_search_guidelines. The phrase 'by its database ID' implies a prerequisite, but that is only clarified in the schema parameter description, not in the tool description itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

it_dp_list_topicsA

List all covered data protection topics with Italian and English names. Use topic IDs to filter decisions and guidelines.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does disclose the returned content (topics with Italian and English names), which is valuable given there is no output schema. However, it says nothing about the ID field, auth requirements, or result size for a listing call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, zero waste, with the core action front-loaded and the downstream use stated second.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, side-effect-free listing tool with no output schema, the description covers what it returns (bilingual topic names) and how the result is consumed. It could note the presence of an ID field, but nothing essential to invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the baseline this is a 4. The mention of 'topic IDs' is only a pointer to other tools' parameters, not this tool's input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb+resource: 'List all covered data protection topics', which is specific and distinguishable from the search/get decision and guideline siblings. It stops short of explicitly naming those siblings, but the topic-enumeration scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tells the agent what the output is for: 'Use topic IDs to filter decisions and guidelines', which implies this is the lookup step that precedes the search tools. It gives clear context but states no explicit when-not or prerequisite conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

it_dp_search_decisionsA

Full-text search across Garante decisions (provvedimenti, sanzioni, ordinanze). Returns matching decisions with reference, entity name, fine amount, and GDPR articles cited. Search in Italian for best results (e.g., 'consenso', 'videosorveglianza', 'Clearview').

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by decision type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Italian (e.g., 'consenso cookie', 'videosorveglianza', 'Foodinho Glovo')
topicNoFilter by topic ID (e.g., 'cookie', 'videosorveglianza', 'profilazione', 'dati_sanitari'). Optional.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It usefully discloses the return fields (reference, entity name, fine amount, GDPR articles) and the Italian-language search requirement, but says nothing about result volume/pagination behavior, empty-result handling, or any rate/permission constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, front-loaded with the core action and resource before the return-fields and language hints. No filler, though the language hint overlaps with the schema's query description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description properly compensates by naming the fields returned (reference, entity, fine amount, GDPR articles) and the search language. It is adequate for calling the tool, missing only routing guidance to it_dp_get_decision for follow-up retrieval.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters including the type enum and topic/limit defaults. The description adds only a reinforcement of the Italian query convention, which is already present in the query parameter description; it does not clarify query-vs-topic interplay.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('full-text search') and resource (Garante decisions, with provvedimenti/sanzioni/ordinanze enumerated), which an agent can distinguish from sibling search tools like it_dp_search_guidelines. It does not explicitly name the sibling get_decisions/get_guidelines tools, so differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'search' plus the query examples implies when to use this over a get-by-id tool, but there is no explicit when-to-use/when-not statement or named alternative (e.g., it_dp_get_decision for a known decision). Usage is implied, not guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

it_dp_search_guidelinesC

Search Garante guidance documents: linee guida, provvedimenti generali, and FAQ. Covers GDPR implementation, cookie e tracciamento, videosorveglianza, profilazione, telemarketing, and more.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by guidance type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query in Italian (e.g., 'cookie tracciamento', 'valutazione impatto', 'trattamento automatizzato')
topicNoFilter by topic ID (e.g., 'cookie', 'videosorveglianza', 'profilazione', 'telemarketing'). Optional.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a read-only search but says nothing about result format, pagination, whether results are snippets or full text, rate limits, or authentication needs. For a zero-annotation tool this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, with the verb and resource front-loaded before the subtype enumeration. The trailing 'and more' is mild filler but the definition wastes no other space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A search tool with no output schema and no annotations needs the description to convey result shape and scoping, and this only conveys subject coverage. Parameters are fully documented in the schema, but return behavior and sibling routing are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented, establishing a baseline of 3. The description's topic list (cookie, videosorveglianza, profilazione, telemarketing) loosely mirrors valid topic IDs but adds no syntax, defaults, or interaction rules beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Search') and resource ('Garante guidance documents'), then enumerates the document subtypes it covers (linee guida, provvedimenti generali, FAQ). It never names the closest sibling, it_dp_search_decisions, so the agent must infer the guidance-vs-decisions split from the resource noun alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use, when-not-to-use, or alternative routing is given. The sibling it_dp_search_decisions covers a parallel search space and it_dp_get_guideline fetches a single document, yet neither is referenced. Coverage lists imply scope but give no selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedit_dp_about
    • First observedit_dp_get_decision
    • First observedit_dp_get_guideline
    • First observedit_dp_list_topics
    • First observedit_dp_search_decisions
    • First observedit_dp_search_guidelines

TDQS

A3.7/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: search vs. get for decisions, search vs. get for guidelines, list topics, and server metadata. No two tools overlap in a way that would cause misselection, and the descriptions make the boundaries explicit.

Naming Consistency4/5

Five of six tools follow a consistent it_dp_<verb>_<noun> snake_case pattern. The lone exception is it_dp_about, which is a metadata helper rather than a verb-led operation, but it is still predictable and readable.

Tool Count5/5

Six tools is well-scoped for a read-only legal-data server. Each tool maps to a core retrieval need without redundancy or bloat.

Completeness5/5

The toolset covers search and retrieval for both Garante decisions and guidelines, plus topic discovery and server metadata. Since the domain is external read-only data, create/update/delete operations are not applicable, and the retrieval lifecycle has no obvious dead ends.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Provides AI-powered access to the largest EU GDPR enforcement decisions database, enabling semantic search, GDPR article lookup, and enforcement statistics across all EU/EEA Data Protection Authorities.
    4
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables searching and analyzing decisions from the Polish Data Protection Authority (UODO) directly within AI clients, allowing full-text search, filtering, and retrieval of GDPR enforcement decisions.
    3
    5 npm
    1
    Apache 2.0
  • F
    license
    Not graded
    quality
    B
    maintenance
    Provides AI assistants with up-to-date legal documents from official sources, enabling accurate legal information retrieval and analysis.
    18
    -