ComplianceGuard MCP

Privacy and compliance checks, built into your workflow.

Scan local codebases for PII handling issues, data flow problems, cookie consent violations, and privacy readiness gaps — all from within your AI assistant.

Disclaimer: ComplianceGuard provides automated pattern detection. Not a substitute for qualified legal counsel.

Quick Start

npx complianceguard-mcp

Claude Desktop config

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "complianceguard": {
      "command": "npx",
      "args": ["-y", "complianceguard-mcp"]
    }
  }
}

Then ask Claude:

"Scan my project at /path/to/my-app for PII issues" "Run a cookie audit on /path/to/my-frontend" "What's my privacy score for /path/to/my-app?"

Tools

Free Tools (7 tools — available now)

| Tool | Description | |:-----|:------------| | scan_pii | Scan codebase for PII field patterns and classify by category (email, phone, address, dob, etc.) | | scan_data_flow | Trace PII fields from collection through storage to external transmission | | cookie_audit | Detect cookie usage and consent-before-set violations (GDPR Art. 7) | | privacy_score | Overall privacy readiness score (0-100) with breakdown and suggestions | | retention_check | Find PII stored without TTL, soft-delete, or retention policy | | consent_check | Scan for consent management patterns in forms and signups | | dependency_audit | Flag dependencies with data-sharing concerns (mixpanel, hotjar, sentry, etc.) |

Pro Tools (6 tools — requires PRO_LICENSE)

| Tool | Description | |:-----|:------------| | gdpr_checklist | Per-article GDPR compliance checklist (Art. 5-35) with evidence and actions | | generate_ropa | Records of Processing Activities (ROPA) template pre-filled from scan results | | generate_dpia | Data Protection Impact Assessment (DPIA) with risk likelihood/impact and mitigations | | diff_scan | Privacy posture diff between two git refs — detects new PII, new cookies, removed controls | | policy_generate | Privacy policy and cookie policy drafts with company name and website URL | | multi_repo_scan | Unified privacy inventory across multiple GitHub repositories |

Free vs Pro

| Feature | Free | Pro | |:--------|:----:|:---:| | PII scanning (12 categories) | Yes | Yes | | Data flow tracing | Yes | Yes | | Cookie audit + consent checks | Yes | Yes | | Privacy score (0-100) | Yes | Yes | | Retention analysis | Yes | Yes | | Consent form analysis | Yes | Yes | | Dependency audit | Yes | Yes | | GDPR article checklist | - | Yes | | ROPA generation | - | Yes | | DPIA generation | - | Yes | | Git diff scanning | - | Yes | | Policy generation | - | Yes | | Multi-repo scanning | - | Yes |

To enable Pro tools, set PRO_LICENSE=your-license-key in your environment.

How it works

ComplianceGuard reads your local codebase using filesystem access only. No code is sent to any external service. All scanning is regex-based pattern matching.

PII categories detected: email, phone, address, IP address, SSN, date of birth, name, location, device ID, financial, health, biometric

Cookie patterns detected: document.cookie =, res.cookie(, cookies.set(, setCookie(, .setCookie(

Data flow tracing: Follows PII fields from API inputs through database operations to external SDK calls (SendGrid, Stripe, analytics, etc.)

Architecture

• Runtime: Node.js 18+, TypeScript
• Protocol: Model Context Protocol (MCP) via stdio
• Storage: SQLite audit log at ~/.complianceguard/audit.db (90-day retention)
• File discovery: fast-glob
• No external API calls — all scanning is local

License

MIT — see LICENSE

Built by Craftpipe — privacy tooling for developers.