GeraCompliance MCP Server

An MCP server that lets AI agents — Claude Desktop, ChatGPT with tools, Cursor, Windsurf, or any MCP client — classify AI systems under the EU AI Act and look up the resulting obligations and regulation, fully offline.

It embeds the real GeraCompliance deterministic classification engine (Articles 5, 6(1), 6(2), 6(3), 50 of Regulation (EU) 2024/1689). No backend, no network, no auth — it computes everything locally, so it gives the same answer the GeraCompliance product gives and is safe to run anywhere.

Orientation only — not legal advice. For a documented conformity package, use the full GeraCompliance product.

Tools

| Tool | What it does | |------|--------------| | classify_ai_system | Run the EU AI Act risk classification from boolean answer keys. Returns the risk tier (prohibited / high_risk / borderline / limited_risk / minimal_risk), triggered articles, obligations, conformity-assessment flag, and a full reasoning trace. | | get_requirements | Given a risk tier, return its obligations, key articles, and whether a conformity assessment is required. | | get_regulation_info | Look up an EU AI Act article by number, or search all articles by keyword. | | list_risk_triggers | List the 8 Article 5 prohibited practices and 8 Annex III high-risk categories, each with the boolean answer key — so an agent can map a plain-language description onto classification inputs. |

A typical agent flow: list_risk_triggers → set the matching boolean keys → classify_ai_system → get_requirements for the resulting tier.

Install & run

# Run directly (no global install) once published to npm:
npx -y @gera-services/mcp-gera-compliance

# Or from this repo:
cd packages/mcp-gera-compliance
npm run build      # tsc --noCheck  -> dist/
node bin/cli.js    # starts on stdio

Client configuration

Claude Desktop / Claude Code (claude_desktop_config.json)

{
  "mcpServers": {
    "gera-compliance": {
      "command": "npx",
      "args": ["-y", "@gera-services/mcp-gera-compliance"]
    }
  }
}

Local (unpublished) variant — point at the built CLI:

{
  "mcpServers": {
    "gera-compliance": {
      "command": "node",
      "args": ["/Users/armen/Gera/packages/mcp-gera-compliance/bin/cli.js"]
    }
  }
}

Cursor / Windsurf (.cursor/mcp.json etc.)

{
  "mcpServers": {
    "gera-compliance": {
      "command": "npx",
      "args": ["-y", "@gera-services/mcp-gera-compliance"]
    }
  }
}

Hosted transport (Streamable HTTP / SSE — for ChatGPT Apps & remote MCP clients)

The same four tools are also served over the MCP Streamable HTTP transport, so remote MCP clients and ChatGPT Apps can connect to a public URL instead of spawning a local stdio process. The HTTP server reuses the exact same tool handlers — it just swaps the transport.

cd packages/mcp-gera-compliance
npm run build           # tsc --noCheck -> dist/ (builds both transports)
npm run start:http      # or: node bin/http.js
# -> listening on http://0.0.0.0:3399/mcp  (POST JSON-RPC; GET /health)

Endpoints:

| Method & path | Purpose | |---|---| | POST /mcp | MCP JSON-RPC (and SSE streaming). This is the MCP endpoint clients connect to. | | GET /health | Plain-text liveness probe (ok) — exempt, never gated. | | GET /mcp | 405 — stateless mode has no server-initiated stream to open. |

It runs stateless (a fresh server per request, no session id) — correct for a read-only, offline, no-auth classifier with no cross-call state, and safe to host behind a serverless function or a horizontally-scaled container.

Configure the host/port via env vars: PORT (or MCP_HTTP_PORT, default 3399) and HOST (default 0.0.0.0).

Connecting a remote MCP client

Point any Streamable-HTTP MCP client at the deployed URL, e.g.:

{
  "mcpServers": {
    "gera-compliance": {
      "type": "streamable-http",
      "url": "https://mcp.geracompliance.com/mcp"
    }
  }
}

For ChatGPT Apps / remote-MCP connectors, register the same https://mcp.geracompliance.com/mcp URL as the server endpoint. No auth is required — the classifier is fully offline and deterministic.

Quick check once running: curl -s http://localhost:3399/health → ok curl -s -X POST http://localhost:3399/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Verify it works

npm run build
node scripts/smoke.mjs

The smoke test speaks raw MCP JSON-RPC over stdio (initialize → tools/list → several tools/call) and asserts the classifications. Expected output ends with ALL SMOKE CHECKS PASSED.

Example

Ask your agent: "We're building an AI tool that screens job applicants and ranks them for recruiters. Is it high-risk under the EU AI Act?"

The agent calls classify_ai_system with annex3_employment_recruitment: true (plus the cat4_* boundary answers) and gets back:

{
  "risk_tier": "high_risk",
  "triggered_articles": ["Article 6(2)", "Annex III (employment_workers_management)"],
  "conformity_assessment_required": true,
  "obligations": ["Establish a risk management system (Article 9).", "..."]
}

License

MIT © Gera Systems Ltd