1. Conduid
  2. Security
  3. EU Audit Trail
MCP server · Security

EU Audit Trail

· github.com/jellewas/eu-audit-mcp

Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

Unclaimed security
InstallView source
37Low

Scored 6 months ago · breakdown

About EU Audit Trail

EU Audit Trail is an MCP server in the Security category: tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

Install

uvx
uvx eu-audit-mcp
pip
pip install eu-audit-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (10)

compliance_checkCheck against EU AI Act Art. 12/19 and GDPR Art. 30

Parameters not published.

execute_erasureGDPR Article 17 right-to-erasure

Parameters not published.

get_pii_summarySummary of detected PII types (counts only)

Parameters not published.

get_session_traceFull ordered trace of a session

Parameters not published.

get_statsSummary statistics over a time period

Parameters not published.

log_data_accessLog a document/data access event

Parameters not published.

log_eventRecord an audit event with automatic PII scanning

Parameters not published.

log_inferenceLog an LLM inference call (model, tokens, cost)

Parameters not published.

query_logSearch events by time range, type, session

Parameters not published.

verify_chainVerify hash chain integrity

Parameters not published.

Ask AI

✦

Ask AI about EU Audit Trail

Powered by Claude · Grounded in docs

I know everything about EU Audit Trail. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ✓README presentThe repository ships documentation.

5 checks have not been run yet.

README

eu-audit-mcp

Tamper-evident audit trail MCP server for EU AI Act and GDPR compliance. Designed to be integrated into a local desktop application via stdio transport.

Features

  • Tamper-evident logging — HMAC-SHA256 hash chain over all events
  • PII scanning — Automatic detection and redaction via Microsoft Presidio (EU patterns)
  • GDPR erasure — Article 17 right-to-erasure support with audit trail
  • Compliance checks — Technical checklist against EU AI Act Articles 12/19 and GDPR Article 30
  • Local-first — All data stays on your machine in a single SQLite file

Regulatory context

This server implements technical measures for the following EU regulations:

Regulation Articles What it requires
EU AI Act (2024/1689) Art. 12 Automatic recording of events (logs) for high-risk AI systems
Art. 19 Retention of automatically generated logs for at least 6 months
GDPR (2016/679) Art. 17 Right to erasure of personal data ("right to be forgotten")
Art. 30 Records of processing activities, including purposes and data categories

The EU AI Act high-risk obligations enter into force on 2 August 2026.

See LEGAL_REFERENCES.md for the full article texts and a detailed mapping of how each tool addresses each requirement.

Disclaimer: This tool provides a technical checklist, not legal advice. Consult qualified legal counsel for compliance decisions.

Quick start

pip install -e ".[dev]"

Run the server (stdio)

python -m eu_audit_mcp.server

MCP client configuration

{
  "mcpServers": {
    "eu-audit": {
      "command": "python",
      "args": ["-m", "eu_audit_mcp.server"],
      "env": {
        "AUDIT_CONFIG": "./audit_config.yaml"
      }
    }
  }
}

Run tests

pytest tests/

MCP Tools

Tool Description
log_event Record an audit event with automatic PII scanning
log_inference Log an LLM inference call (model, tokens, cost)
log_data_access Log a document/data access event
query_log Search events by time range, type, session
get_session_trace Full ordered trace of a session
get_stats Summary statistics over a time period
compliance_check Check against EU AI Act Art. 12/19 and GDPR Art. 30
execute_erasure GDPR Article 17 right-to-erasure
get_pii_summary Summary of detected PII types (counts only)
verify_chain Verify hash chain integrity

Configuration

Copy the example config and customize:

cp audit_config.example.yaml audit_config.yaml

Set the AUDIT_CONFIG environment variable to point to your config file. Do not commit audit_config.yaml if it contains a chain_secret — it is in .gitignore by default.

Security

See SECURITY.md for the threat model, security measures, and vulnerability reporting.

License

Apache-2.0

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About EU Audit Trail

How do I install EU Audit Trail?

Run uvx eu-audit-mcp, then add the server to your MCP client's configuration.

Is EU Audit Trail safe to use with an AI agent?

Its trust score is 37 out of 100 (low). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is EU Audit Trail still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.