CoolFace
Apppublic

DebugDruid/mcp_gdpr_checker

sourceHugging Faceotherupdated 24d agoView on Hugging Face
0likes
App README

GDPR MCP Compliance Checker

A tool for checking whether Model Context Protocol (MCP) servers - and the companies or developers behind them - have published privacy policies, GDPR documentation, security information, and contact details. Uses real-time web search (via OpenAI) rather than a static database, so results reflect what's actually published right now.

![Continuous Integration](https://github.com/CharleyRutledge/GDPR-MCP-compliance-checker/actions/workflows/ci.yml)

Features

  • —Direct URL Analysis: Analyze MCP servers from GitHub, Smithery, MCP Market, MCP.so, or NPM URLs
  • —Real Web Search: Uses OpenAI's WebSearchTool to find privacy policies and GDPR documentation as they exist today, run concurrently for faster results
  • —Intelligent Context Extraction: Distinguishes the MCP's actual developer/company from the hosting platform (e.g. GitHub's own privacy policy is not attributed to every project merely hosted there)
  • —AI-Enhanced Analysis: Rule-based scoring plus AI-generated recommendations
  • —Email Templates: Ready-to-send templates for contacting MCP maintainers about gaps found
  • —Per-Session Privacy: Consent, rate limiting, and data summaries are isolated per visitor - no shared state between users
  • —Minimal Data Footprint: No database, no persistent storage; analysis runs in memory and is discarded when the session ends

How to Use

  1. 1.Enter MCP URL: Paste a direct URL to an MCP server:
  2. 2.GitHub: https://github.com/owner/repo
  3. 3.Smithery: https://server.smithery.ai/@owner/mcp/mcp
  4. 4.MCP Market: https://mcpmarket.com/server/mcp-name
  5. 5.MCP.so: https://mcp.so/server/mcp-name/owner
  6. 6.NPM: https://www.npmjs.com/package/@company/mcp
  1. 1.Check the consent box and click "Analyze MCP". This sends the MCP name/URL you enter to OpenAI for the search - see Privacy & GDPR Compliance below. A typical analysis takes roughly 30-60 seconds.
  1. 1.Review Results:
  2. 2.Privacy policies, GDPR documentation, security info, and contact details found
  3. 3.Who's actually responsible under GDPR for the MCP you're evaluating vs. for deploying it yourself
  4. 4.Email template for contacting maintainers
  5. 5.Next steps and recommendations

Example URLs to Try

https://github.com/github/github-mcp-server
https://github.com/makenotion/notion-mcp-server
https://github.com/stripe/agent-toolkit
https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking
https://mcp.so/server/edgeone-pages-mcp/TencentEdgeOne
https://www.npmjs.com/package/@archbee/mcp

Running Locally

bash
git clone https://github.com/CharleyRutledge/GDPR-MCP-compliance-checker.git
cd GDPR-MCP-compliance-checker
pip install -e ".[dev]"        # installs runtime + test/lint dependencies
echo "OPENAI_API_KEY=sk-..." > .env   # see Environment variables below
python app.py                  # serves on http://localhost:7860

pip install -e . (without [dev]) installs just the runtime dependencies. requirements.txt is kept as a synced mirror of pyproject.toml's dependency list for tools that expect one.

Environment variables

VariableRequiredPurpose
OPENAI_API_KEYYesPowers the real-time web search and AI-enhanced analysis - the tool falls back to a non-functional "Demo Mode" without it
PUSHOVER_APP_TOKEN / PUSHOVER_USER_KEYNoOptional abuse-prevention notifications (validation failures/errors) to the tool operator - the tool works fully without these

Testing

bash
pytest                          # full suite (228 tests)
black --check --diff .          # formatting
isort --check-only --diff .     # import order
flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics   # syntax/critical errors (must pass)

CI (.github/workflows/ci.yml) runs lint, tests, and a security scan on every push to main and every PR.

Privacy & GDPR Compliance of This Tool Itself

This tool practices what it checks for. In brief:

  • —Consent and session data are isolated per visitor - no shared file, no cross-user leakage.
  • —The OpenAI transfer is required, not optional: every analysis sends the MCP name/URL you enter to OpenAI for web search and AI analysis. The consent checkbox discloses this explicitly.
  • —No persistent storage: everything runs in memory and is discarded when your session ends, the server restarts, or you click "Revoke Consent."
  • —Full data subject rights are built in: "View My Data," "Export My Data" (in-memory Excel export, no server-side file), and "Revoke Consent" (erasure) are all live in the interface.
  • —Each processing purpose has one specific GDPR Art. 6(1) legal basis - see the full breakdown in `docs/privacy_policy.md`.

Read the complete policy at `docs/privacy_policy.md`, or click "View Privacy Policy" in the running app.

Important: whether an MCP's author published a privacy policy is a useful signal, but the organization that deploys an MCP server as part of its own AI agent - not the MCP's author - carries GDPR liability for whatever personal data flows through it. This tool provides guidance, not legal advice; consult a qualified professional for definitive compliance guidance.

Copyright

Copyright © 2025 GDPR MCP Compliance Checker. All Rights Reserved.

This software is proprietary. See LICENSE for full terms.

Support

For issues or questions, visit the GitHub repository.