buildsyncinc/gibs-mcp

**Regulatory compliance for AI-powered development tools** — classify AI systems, check obligations, and get article-level citations across 240+ articles and 3 major regulations.
Full Documentation · Get API Key · API Reference
---
Overview
Gibs MCP Server connects your AI development environment directly to a regulatory compliance knowledge base. Currently covering:
| Regulation | Scope | Articles |
|---|---|---|
| **EU AI Act** | AI system classification, prohibited practices, obligations by risk level | 113 articles + 13 annexes |
| **GDPR** | Data protection, processing obligations, data subject rights | 99 articles |
| **DORA** | ICT risk management, incident reporting, third-party oversight for financial entities | 64 articles + 12 delegated/implementing acts |
Every response includes **article-level citations** to binding legal text, with real-time corpus updates as regulations evolve.
---
Quick Start
1. Get an API Key
Sign up at gibs.dev and grab your API key from the dashboard.
2. Connect via Claude Desktop
Add this to your Claude Desktop configuration file (claude_desktop_config.json):
3. Authenticate
Pass your API key as the user_api_key parameter when calling any tool, or set it in your environment:
---
Tools
classify_ai_system
Classify an AI system under AI Act risk levels (unacceptable, high-risk, limited, minimal) with full legal reasoning.
| Parameter | Type | Required | Description |
|---|---|---|---|
| description | string | Yes | What the AI system does (10–5000 chars) |
| data_types | list[string] | No | Types of data processed (e.g., ["biometric", "personal"]) |
| decision_scope | string | No | What decisions the system influences |
| sector | string | No | Industry sector (e.g., "healthcare", "finance", "hr") |
**Example prompt:**
> Classify my facial recognition attendance system for schools
**What you get back:**
- Risk classification (e.g., **high-risk** under Annex III, point 1(a))
- Specific Article 6 analysis with Annex III cross-references
- Applicable obligations based on classification
- Relevant exemptions or exceptions, if any
---
check_compliance
Ask any regulatory compliance question and get a structured answer with article-level citations.
| Parameter | Type | Required | Description |
|---|---|---|---|
| question | string | Yes | Compliance question (10–2000 chars) |
| system_description | string | No | Context about your AI system or organization |
| regulation | string | No | Target regulation: "ai_act", "gdpr", "dora", or "both" (default: "both") |
**Example prompts:**
> What are the GDPR requirements for a data breach notification?
Returns Article 33 (notification to supervisory authority) and Article 34 (communication to data subjects) obligations, including the 72-hour notification timeline, required content, and exceptions.
> Does DORA apply to a fintech startup processing payments?