Compliance MCP server

RuleMesh MCP

Engineered Compliance Infrastructure for engineers and AI agents.

RuleMesh delivers source-traced rules for GDPR and the EU AI Act: determine applicability, retrieve the requirements and implementation checklists that apply to a system, submit evidence signals, and track human verification. It runs as a hosted remote MCP server at https://api.rulemesh.com/mcp (Streamable HTTP, OAuth login), consumable from any MCP client.

This repo is the canonical home for the server's listing (server.json, published to the MCP Registry as com.rulemesh/compliance) and client setup docs.

Connect

You authenticate once in the browser (email/password or Google); no API key to manage. A RuleMesh account is required. The FREE tier includes GDPR. EU AI Act access and control mappings are available with a paid subscription.

OpenAI Codex

Add to ~/.codex/config.toml:

[features]
rmcp_client = true            # enables the remote MCP client (use experimental_use_rmcp_client = true on older Codex)

[mcp_servers.rulemesh]
url = "https://api.rulemesh.com/mcp"
startup_timeout_sec = 30
tool_timeout_sec = 120

Then codex mcp login rulemesh (opens the browser for OAuth), and /mcp in the TUI to confirm the tools loaded.

Claude Code

claude mcp add --transport http rulemesh https://api.rulemesh.com/mcp

Run /mcp and follow the browser login. A packaged plugin is also available at RuleMesh/rulemesh-claude-plugin.

Claude Desktop / Cursor / VS Code / other clients

Add a remote (Streamable HTTP) MCP server pointing at https://api.rulemesh.com/mcp. For example, Claude Desktop (claudedesktopconfig.json) or Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "rulemesh": {
      "type": "streamable-http",
      "url": "https://api.rulemesh.com/mcp"
    }
  }
}

What you get

The server groups its 19 tools around one loop: plan, pull, implement, prove. GDPR and the EU AI Act are live today, with access depending on the account's plan.

• Discovery and scoping: listregulations, listframeworks, lookupdefinition, getcomplianceplan, scopenextquestion, scopeclassify, scoperetrievesource, scopequeryapplicable, scopeupdateprofile
• Implement: pullrules, scancompliance
• Prove: submitsignals, submitsignals_batch
• Track: getprogress, getticketstatus, getscansessions, startscan, endscan, resumesession

Four prompts package the common workflows: implementbundle, scanandreportbundle, reviewbundle, and plancompliance. One resource, regulation://{id}, returns regulation metadata.

Your coding agent reads your repository locally using RuleMesh requirements. RuleMesh does not read or receive source-code contents. Evidence submissions contain the evidence description and relevant filenames; they do not certify compliance or mark a requirement verified. Verification remains a human action.

Example prompts

• "Which regulations can I use on my current RuleMesh plan?"
• "Does the EU AI Act apply to this system? Ask the necessary scoping questions and cite the source provisions behind the result."
• "Give me a prioritised GDPR implementation plan for this application."
• "Pull the GDPR rules for my data-export feature and give me an engineering checklist."
• "Review this repository against the pulled requirements. Submit only evidence signals and filenames; do not upload source code or mark anything verified."

Authentication

OAuth 2.1 with PKCE and Dynamic Client Registration. Clients register themselves and open a browser login; tokens refresh automatically.

About RuleMesh

Shortened. The full README is on GitHub.