ComplyEdge TrustLint: offline EU AI Act compliance checks MCP server

ComplyEdge

EU AI Act Article 5 and Article 50 runtime deny for AI agents. The platform enforces in production, on every request — and the same discipline is available to your agent as an MCP server that checks and scans the text you pass it, offline, with an article citation on every finding. Classifiers (eu-ai-act-) score the system; ComplyEdge denies this* prompt or output. Article 50 here is unlabeled or deceptive use, not C2PA.

Ships three ways: a Python SDK, an offline CI linter (TrustLint), and an MCP server — a Model Context Protocol server that exposes compliance checks as tools to any MCP host (Claude, Cursor, MCP Inspector).

Article 5 is already law. GPAI fines have applied since 2 August 2026. Your AI is either compliant right now, or it isn't.

What does your compliance tool tell a regulator when it blocks a request? A probability score?

ComplyEdge says: Article 5(1)(a), rule rego-art5-1a-001, timestamp, input hash. One is an audit trail. One is a guess.

MCP Server (Model Context Protocol)

ComplyEdge TrustLint is an MCP server built on the official MCP Python SDK (mcp>=1.9). It gives an agent article-cited compliance checks instead of a probability score, and it runs fully offline: no API key, no network call, rules evaluated from the bundled YAML corpus.

Tools (the server exposes MCP tools only — no resources, no prompts; all are read-only and idempotent):

Local (stdio) — for Claude Desktop, Cursor, MCP Inspector, or any MCP host:

pip install 'complyedge[mcp]'
complyedge-mcp          # or: python -m complyedge.mcp_server

{
  "mcpServers": {
    "complyedge": {
      "command": "complyedge-mcp"
    }
  }
}

Remote (Streamable HTTP): https://mcp.complyedge.io/mcp

sandboxcheck is the one tool that needs a key. Locally, set COMPLYEDGEAPI_KEY in the server's environment (without it the tool is not listed and the server stays fully offline). On the hosted server it is always listed and works only for a caller that sends its own key as the Authorization: Bearer header on the MCP connection; the key is never a tool argument, never logged, and the hosted server keeps no keys.

{
  "mcpServers": {
    "complyedge": {
      "url": "https://mcp.complyedge.io/mcp",
      "headers": { "Authorization": "Bearer ce_live_your_api_key" }
    }
  }
}

Server source: sdks/python/complyedge/mcpserver.py. Full MCP docs: sdks/python/README.md. The three offline tools use the TrustLint engine and never call the hosted OPA/Rego policy API; sandboxcheck is the one that does, and only with your key.

Install (coding agents):

Shortened. The full README is on GitHub.