ComplianceStack

Enterprise AI Governance — Zero-Data-Egress Compliance Auditing

The first open-source MCP server that audits AI models against 5 regulatory frameworks in real-time.

Quick Install | Features | 17-Phase Pipeline | Legal Audit | Verify Tests | API | Contributing

---

Quick Install

Option 1: npx (Recommended, requires Node 20+)

npx compliance-stack-mcp-server

Add to your MCP client:

{
  "mcpServers": {
    "compliance-stack": {
      "command": "npx",
      "args": ["compliance-stack-mcp-server"]
    }
  }
}

Option 2: Docker (Full stack)

git clone https://github.com/nyayoshbharuchanb15-max/ComplianceStack.git
cd ComplianceStack
cp .env.example .env
docker compose up --build -d

---

Why ComplianceStack?

AI regulation is here. The EU AI Act became law in August 2024. GDPR fines exceeded €2 billion in 2024. India's DPDP Act is being enforced. Your AI models need compliance auditing — and you need it to be fast, private, and auditable.

ComplianceStack is a 17-phase audit pipeline that plugs directly into your AI assistant via the Model Context Protocol. Every audit runs entirely on-premise with zero data leaving your infrastructure by default.

MCP Capabilities: 17 tools | 5 resources | 4 prompts | 3 transports (stdio, SSE, Streamable HTTP)

Key Differentiators

Feature	ComplianceStack	Traditional GRC Tools
MCP Integration	Native — 17 tools via stdio/SSE/Streamable HTTP	Requires separate API integration
Zero Data Egress	All operations in-process	Cloud-dependent
Real-time Auditing	Instant feedback in your IDE	Batch processing
17-Phase Pipeline	Risk, Bias, DPIA, Drift, Agent Trust, and more	Typically 3-5 checks
W3C Verifiable Credentials	Cryptographically signed audit certificates	PDF reports
BLOCKER FAIL	Prevents certification of non-compliant models	Manual review
Open Source	Full codebase, self-hostable	Proprietary SaaS

Validation Status (283 tests passing | Legal Citation Audit)

Category	Status	Details
MCP Protocol	✅	17 tools, JSON Schema validation, 3 transport modes
Security	✅	W3C VCs, Merkle anchoring, Ed25519 signing
Regulatory Coverage	✅	5 frameworks, 17 phases with real audit logic
Audit Trail	✅	Mutation logging across all phases
Cryptography	✅	Real Ed25519 + Merkle trees, no mocks
E2E Tests	✅	283 tests (39 TypeScript + 244 Python)
Schema Validation	✅	additionalProperties: false enforcement
Legal Citations	✅	23 MISMATCHES fixed against actual statute text

---

Features

Architecture

┌──────────────────────┐     ┌──────────────────────────────────────────────┐
│   AI Assistant       │     │         ComplianceStack MCP Server           │
│  (Claude Desktop,    │◄───►│                                              │
│   Cursor, etc.)      │     │  TypeScript MCP Server        Python Backend │
│                      │     │  ┌──────────────────┐     ┌───────────────┐  │
│                      │     │  │ 17 MCP Tools      │────►│ FastAPI        │  │
│                      │     │  │ (Risk, Bias,      │     │ (Audit Logic)  │  │
│                      │     │  │  DPIA, Drift...)  │     │               │  │
│                      │     │  └──────────────────┘     └───────┬───────┘  │
│  ┌────────────────┐  │     └─────────┼─────────────────────────┼──────────┘
│  │  OAuth 2.1 +   │  │               │                         │
│  │  RBAC          │  │  ┌────────────┼─────────────────────────┼──────────┐
│  └────────────────┘  │  │            │       Data Layer        │          │
│                      │  │            ▼                         ▼          │
│  Zero Egress ────────┤  │ ┌──────────────┐ ┌──────────────┐ ┌─────────┐  │
│  On-Premise ─────────┤  │ │  PostgreSQL  │ │    Neo4j     │ │  Redis  │  │
│                      │  │ │  Evidence    │ │  Provenance  │ │ Streams │  │
│                      │  │ │  Store +     │ │  Graph +     │ │(Re-audit│  │
│                      │  │ │  Merkle Tree │ │  Discovery   │ │ Events) │  │
│                      │  │ └──────────────┘ └──────────────┘ └─────────┘  │
│                      │  └────────────────────────────────────────────────┘
└──────────────────────┘

17-Phase Audit Pipeline

Phase	Tool	What It Does
1	classify_ai_risk	EU AI Act risk tier classification (Prohibited → Minimal)
2	discover_supply_chain	Filesystem crawler populates Neo4j provenance graph
3	audit_supply_chain	Neo4j graph query for data lineage & IP clearance
4	verify_human_oversight	HITL/kill-switch verification (BLOCKER FAIL if missing)
5	run_bias_assessment	Fairlearn metrics: demographic parity, equal opportunity, disparate impact
6	generate_dpia	GDPR Art. 35 DPIA with cross-border transfer analysis
7	run_adversarial_tests	Prompt injection, jailbreak, OOD, model inversion, membership inference
8	score_audit_weighted	Aggregate score (0–100), BLOCKER FAIL halts certification
9	generate_audit_certificate	W3C Verifiable Credential (Ed25519-signed) issued
10	monitor_model_drift	Evidently AI drift detection, auto re-audit via Redis Streams
11	audit_session_memory	STM/LTM isolation, context window limits, wipe-on-expiry
12	audit_rag_quality	Retrieval accuracy, embedding bias, freshness, hallucination rate
13	audit_prompt_templates	Injection surface, few-shot bias, instruction safety
14	audit_agent_trust	Agent identity, P2P integrity, collusion detection
15	audit_tool_permissions	Privilege escalation, unauthorized access, permission drift
16	classify_agent_autonomy	Assistive → Fully Autonomous classification (BLOCKER if uncontrolled)

Regulatory Coverage

Framework	Articles/Clauses	What We Audit
EU AI Act (Reg. 2024/1689)	Art. 5, 6, 10, 12, 14, 15, Annex I–III	Risk classification, supply chain, human oversight, bias, adversarial robustness
NIST AI RMF (AI 100-1)	MAP 1.1, GOVERN 1.2, 3.2, MEASURE 1.3, 2.2, 3.3, 4.1	Risk mapping, governance, measurement, drift monitoring
ISO/IEC 42001:2023	Clauses 6.1, 6.2, 7.4.3, 7.5, 8.1.2, 8.1.3, 8.2, 9.1	AIMS compliance, documented information, monitoring
GDPR (Reg. 2016/679)	Art. 5, 9, 22, 25, 30, 35, 44–49	DPIA, ROPA, DSAR, cross-border transfers
India DPDP Act 2023	Sec. 5–14	Consent, fiduciary duties, data principal rights

---

External Service Configuration

By default, ComplianceStack operates with zero data egress — all operations run locally. However, adversarial testing (Phase 7) can optionally route prompts to an external LLM endpoint for more comprehensive testing.

Variable	Default	Description
ADV_ENDPOINT_URL	"" (empty)	Optional. External endpoint for adversarial testing prompts. When set, adversarial tests route to this URL. When empty, adversarial tests run locally or are skipped.
ADV_API_KEY	"" (empty)	API key for the external adversarial endpoint (required only if ADV_ENDPOINT_URL is set).
ADV_TARGET_MODEL	gpt-4o-mini	Model name used at the external endpoint for adversarial test generation.
ADV_JUDGE_MODEL	gpt-4o-mini	Model name used at the external endpoint for adversarial test evaluation.

What remains zero-egress regardless of configuration:

• Risk classification (EU AI Act, NIST, ISO, GDPR, DPDP)
• Supply chain audit and provenance graph (Neo4j)
• Human oversight verification
• Bias assessment (Fairlearn)
• DPIA generation
• Weighted scoring and certification
• W3C Verifiable Credential signing
• Drift monitoring
• Session memory, RAG quality, prompt safety, agent trust, tool permissions, and agent autonomy audits

---

MCP Client Configuration

ComplianceStack supports all three MCP transport modes: stdio, SSE, and Streamable HTTP.

Claude Desktop (Stdio)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "compliance-stack": {
      "command": "docker",
      "args": ["exec", "-i", "compliance-stack-mcp", "node", "dist/index.js"],
      "env": { "PYTHON_BACKEND_URL": "http://python-backend:8000" }
    }
  }
}

Cursor / Windsurf (SSE)

{
  "mcpServers": {
    "compliance-stack": {
      "url": "http://localhost:3000/sse"
    }
  }
}

Streamable HTTP (Modern MCP Clients)

{
  "mcpServers": {
    "compliance-stack": {
      "url": "http://localhost:3000/mcp",
      "transport": "streamable-http"
    }
  }
}

Set MCP_TRANSPORT=streamable-http in your .env to enable the Streamable HTTP transport on port 3000.

Run Your First Audit

Ask your AI assistant:

"Run a full audit on model 'my-model-v1'. Classify it as a general-purpose AI used in employment with profiling capabilities, no kill-switch, sensitive features: race, gender, age. Data controller: Acme Corp, DPO: Jane Doe."

What happens:

1. Risk classification → HIGH-RISK (employment + profiling)
2. Supply chain audit → IP clearance check
3. Human oversight → BLOCKER FAIL (no kill-switch)
4. Bias assessment → Demographic parity across 3 features
5. DPIA generation → GDPR Art. 35 compliance
6. Adversarial testing → Prompt injection + jailbreak
7. Weighted score → CERTIFICATION HALTED (blocker detected)
8. Remediation guidance → Specific steps to fix

---

API Reference

Python Backend Endpoints

Method	Path	Description
GET	/health	Health check
POST	/api/auth/token	OAuth 2.1 token issuance
POST	/api/risk/classify	Phase 1: Risk classification
POST	/api/supply-chain/discover	Phase 2: Auto-discover models/datasets
POST	/api/supply-chain/audit	Phase 3: Supply chain audit
POST	/api/human-oversight/verify	Phase 4: Human oversight
POST	/api/bias/assess	Phase 5: Bias assessment
POST	/api/dpia/generate	Phase 6: DPIA generation
POST	/api/adversarial/run	Phase 7: Adversarial testing
POST	/api/scoring/weighted	Phase 8: Weighted scoring
POST	/api/certificate/generate	Phase 9: VC certificate
POST	/api/drift/monitor	Phase 10: Drift monitoring
POST	/api/dpdp/assess	India DPDP Act compliance
POST	/api/ropa/generate	GDPR Art. 30 ROPA
POST	/api/dsar/process	GDPR Art. 15–17 DSAR/Erasure
POST	/api/session-memory/audit	Session memory isolation audit
POST	/api/rag-quality/evaluate	RAG quality evaluation
POST	/api/prompt-audit/evaluate	Prompt template safety audit
POST	/api/agent-trust/evaluate	Agent trust verification
POST	/api/tool-permissions/evaluate	Tool permission boundary audit
POST	/api/agent-autonomy/classify	Agent autonomy classification

MCP Tools

Tool	Parameters	Returns
classify_ai_risk	modelId, modelType, sector	Risk tier + rationale
discover_supply_chain	modelId, modelSearchPaths?, dataSearchPaths?	Discovery summary
audit_supply_chain	modelId, deepScan?	Provenance report
verify_human_oversight	modelId, hasHumanInTheLoop, hasKillSwitch, deploymentContext	Oversight certificate
run_bias_assessment	modelId, datasetSample, sensitiveFeatures, fairnessThreshold?	Bias report
generate_dpia	modelId, dataController, dpoName, processingPurpose, dataCategories	DPIA report
run_adversarial_tests	modelId, testSuites, severityThreshold?	Adversarial report
score_audit_weighted	modelId, all phase results	Weighted score + BLOCKER check
generate_audit_certificate	modelId, weightedScore, tier, compliant, issuerName	W3C VC-JSON
monitor_model_drift	modelId, referenceData, productionData, features	Drift report
assess_dpdp_compliance	modelId, dataFiduciary	DPDP Act compliance report
audit_session_memory	modelId, sessionId, stmConfig, ltmConfig?, isolationLevel	Memory isolation audit
audit_rag_quality	modelId, vectorDbConfig, sampleQueries, freshnessPolicyDays?	RAG quality report
audit_prompt_templates	modelId, promptTemplates, fewShotExamples?, systemPrompt?	Prompt safety audit
audit_agent_trust	modelId, agents, messageBusConfig?, p2pEnabled?	Agent trust report
audit_tool_permissions	modelId, toolRegistry, accessLogs	Permission boundary report
classify_agent_autonomy	modelId, agentType, hasHumanOversight, canMakeDecisions	Autonomy classification

---

W3C Verifiable Credentials

Audit certificates are issued as W3C VCs with Ed25519 cryptographic proof:

{
  "@context": ["https://www.w3.org/2018/credentials/v1", "https://w3id.org/security/suites/ed25519-2020/v1"],
  "id": "urn:uuid:...",
  "type": ["VerifiableCredential", "AIAuditCertificate"],
  "issuer": { "id": "did:web:governance.internal:...", "name": "..." },
  "credentialSubject": {
    "modelId": "model-llm-v2",
    "auditScore": 92.5,
    "tier": "limited",
    "compliant": true
  },
  "proof": { "type": "Ed25519Signature2020", "proofValue": "z..." }
}

---

Security

Feature	Description
Zero Data Egress	All operations in-process by default (adversarial testing is optional external)
OAuth 2.1 + RBAC	Admin, auditor, viewer roles with scoped endpoints
PII Redaction	Middleware intercepts and redacts PII from API responses
Ed25519 Signing	Keys never leave the container
Merkle Audit Trail	Tamper-evident evidence chain
On-Premise Only	No telemetry, no external dependencies
DNS-Rebinding Protection	Origin header validation + localhost binding by default

HTTP Transport Security

The SSE and Streamable HTTP transports bind to 127.0.0.1 by default, preventing access from other machines. Origin header validation rejects requests from unexpected origins (e.g. a malicious webpage using a victim's browser to reach a local MCP server).

Variable	Default	Description
MCP_HTTP_HOST	127.0.0.1	Bind address. Set to 0.0.0.0 to listen on all interfaces (e.g. Docker).
MCP_ALLOWED_ORIGINS	(empty)	Comma-separated allowlist of additional origins beyond localhost.

Non-browser clients (curl, MCP CLI, server-to-server) that don't send an Origin header are always allowed. Requests from http://localhost:* and http://127.0.0.1:* are always allowed.

---

Development

# Python backend
cd python-backend
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
uvicorn main:app --reload --port 8000

# MCP server (in another terminal)
cd mcp-server
npm install
npm run dev

# Tests
cd python-backend && pytest tests/

---

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

---

Legal Citation Audit

ComplianceStack includes a full legal citation audit verifying every regulatory claim in the codebase against the actual current text of each framework. This is not legal advice — it's a mechanical fact-check of code claims vs. statute text.

What was audited

Framework	Source	Claims checked
EU AI Act (Reg. 2024/1689)	EUR-Lex consolidated text	25
GDPR (Reg. 2016/679)	EUR-Lex + gdpr-info.eu	21
NIST AI RMF 1.0	Official NIST Playbook	8
DPDP Act 2023	Official Gazette + Rules 2025	21
ISO/IEC 42001:2023	Paywalled (UNVERIFIABLE)	11

Results (before fixes)

Status	Count
MATCH	28
MISMATCH	23
PARTIAL/IMPRECISE	14
UNVERIFIABLE (ISO)	11
JUDGMENT CALL	1

Critical issues found and fixed

• DPDP Act section mapping was systematically wrong — entire routers/dpdp.py had sections shifted by 1-2 (e.g., Sec. 5 cited for consent when it's actually Sec. 6)
• EU AI Act Art. 12 cited for "Technical documentation" — Art. 12 is record-keeping; Art. 11 is technical documentation
• NIST GOVERN 1.5 was fabricated — this subcategory doesn't exist in the framework
• DPO obligation misattributed as general — Sec. 10(2)(a) only applies to Significant Data Fiduciaries
• Kill-switch BLOCKER narrowed to real-time/autonomous — Art. 14(4)(e) requires it for ALL high-risk systems
• Phantom citations: "Sec. 7(5)", "Sec. 8(9)", "Sec. 13(5)" don't exist in the DPDP Act

Full audit report: LEGAL-CITATION-AUDIT.md

---

Verify Tests

Anyone can independently verify that all tests pass. No external services required.

Prerequisites

• Python 3.12+ with pip
• Node.js 20+ with npm

Quick verification (30 seconds)

# Clone the repo
git clone https://github.com/nyayoshbharuchanb15-max/ComplianceStack.git
cd ComplianceStack

# Run MCP server tests (39 tests)
cd mcp-server && npm install && npm test

# Run Python backend tests (244 tests)
cd ../python-backend && pip install -r requirements.txt
python -m pytest tests/ --ignore=tests/test_e2e_pipeline.py -q

Expected output

MCP server (mcp-server/):

 ✓ src/__tests__/index.test.ts (39 tests)
 Test Files  1 passed (1)
      Tests  39 passed (39)

Python backend (python-backend/):

244 passed, 29 warnings

What the tests cover

Test suite	Count	What it verifies
MCP protocol	39	Tool registration, JSON Schema validation, error handling, Origin validation
Risk classification	8	EU AI Act Art. 5/6 logic, prohibited practices, Annex III mapping
Human oversight	5	Art. 14 kill-switch BLOCKER, HITL verification, deployment contexts
DPIA generation	12	GDPR Art. 35 content, cross-border transfer analysis
ROPA generation	8	GDPR Art. 30 field completeness, 7 mandatory fields
DSAR handling	6	GDPR Art. 15/17 access and erasure
Bias assessment	8	Fairlearn metrics, demographic parity, disparate impact
Adversarial testing	15	Prompt injection, jailbreak, OOD, model inversion
DPDP compliance	12	Sec. 5-16 section mapping, consent, SDF obligations
Supply chain	10	Neo4j provenance, IP clearance, lineage
Crypto signing	8	Ed25519 VC signing, Merkle anchoring
Auth & RBAC	15	OAuth 2.1, scope enforcement, rate limiting
Other services	98	Drift detection, session memory, RAG quality, agent trust, tool permissions

---

License

This project is licensed under the Apache License, Version 2.0 — Copyright © 2026 Nyayosh Bharuchanb15-Max.

See LICENSE for the full text, and NOTICE for required attribution notices.

Trademark & Naming

The ComplianceStack name, logo, and branding are not covered by the Apache 2.0 license and may not be used to endorse or promote derived products without written permission. Forks and derivatives should use a different project name.

---

Built with care for the AI governance community.

GitHub | Issues