DPOLens MCP server

DPOLens is an open-source MCP server that gives your AI coding assistant your organisation's privacy policies and the law, with exact, versioned citations.

Get started · Docs · Connect your AI assistant · Search scores · Contribute

[!NOTE]

Pre-release. 0.1.0-rc.3 is a release candidate for 0.1.0, and docker compose up

downloads its images. Interfaces (the HTTP API, the pack format, the database schema) change

without notice until 1.0. What exists today has the detail, and

watching the repository tells you when 0.1.0 lands.

What changes

Say you ask your AI assistant to log failed sign-ins, so you can debug them.

log is kept until someone remembers to delete it.

• Without DPOLens, it writes each user's email address into the log in plain text, and the

addresses in logs are masked, and logs are kept for 90 days. So it masks the email address, sets the logs to be deleted after 90 days, and tells you which rule it followed, so whoever reviews the code can check it.

• With DPOLens, it checks your company's privacy policy first. The policy says email

You don't have to learn the law or change how you work: the rules are applied while the code is being written, not after an audit or an incident. The introduction says more.

Get started

You need Git, Docker with Compose, and an AI assistant that speaks MCP (Claude Code, Codex, Cursor or GitHub Copilot in VS Code).

git clone https://github.com/alkhatibdev/dpolens.git
cd dpolens

printf 'DPOLENS_OWNER_PASSWORD=%s\nDPOLENS_APP_PASSWORD=%s\n' \
  "$(openssl rand -hex 24)" "$(openssl rand -hex 24)" > .env

docker compose up -d
docker compose exec api dpolens init

init asks for your email address, your name, a password, and which laws apply to your organisation. Then sign in to the dashboard at http://localhost:8080, make a token under Tokens, and connect your AI assistant to http://localhost:8765/mcp with it. Get started has every step, and Connect your AI assistant has the configuration for Claude Code, Codex, Cursor and GitHub Copilot in VS Code.

Why this exists

Most weeks you write code that touches someone's personal data. You log an email address to debug a problem. You add a phone number column. You decide that deleted accounts stay in the database for ninety days, because ninety sounded about right.

Every one of those is a decision with rules attached, and the organisation is on the hook for getting them wrong. Most developers have never read those rules. We are not lawyers, nobody hands us the retention policy on the first day, and the law is long and written for people who are.

Now the AI assistant writes a lot of that code. It is fast, it sounds sure of itself, and it has never seen your organisation's policies. What it knows about the law is a blurry memory from training: close enough to sound right, not close enough to act on.

Shortened. The full README is on GitHub.