airblackbox/air-blackbox-mcp

EU AI Act compliance scanning for **Claude Desktop**, **Claude Code**, **Cursor**, and any MCP-compatible client.
Unlike other compliance scanners that only report problems, AIR Blackbox also **remediates** - generating working code fixes, trust layer integrations, GDPR compliance checks, bias analysis, and full compliance reports. Under the hood, the scanning feeds into **air-trust**, a cryptographic audit chain (HMAC-SHA256) with Ed25519 signed handoffs that ensures compliance data integrity.
14 Tools (10 base + 4 SDK-powered)
| Tier | Tool | What it does | Requires SDK |
|------|------|-------------|---|
| Scanning | scan_code | Scan a code string for all 6 EU AI Act articles (Python, notebooks, TypeScript, JavaScript, Java, Kotlin with the SDK; Python without) | Recommended |
| Scanning | scan_file | Read and scan a single source file | Recommended |
| Scanning | scan_project | Recursively scan a project directory | Recommended |
| Analysis | analyze_with_model | Deep analysis via local fine-tuned model (Ollama) | No |
| Analysis | check_injection | Detect prompt injection attacks (15 patterns) | No |
| Analysis | classify_risk | Classify tools by EU AI Act risk level | No |
| Remediation | add_trust_layer | Generate trust layer integration code | No |
| Remediation | suggest_fix | Get article-specific fix recommendations | No |
| Documentation | explain_article | Technical explanation of EU AI Act articles | No |
| Documentation | generate_compliance_report | Full markdown compliance report | No |
| GDPR | scan_gdpr | GDPR-specific compliance scan | Yes |
| Bias | scan_bias | Bias and fairness analysis | Yes |
| Validation | validate_action | Validate agent actions before execution (Article 14) | Yes |
| History | compliance_history | View past scans, trends, and compliance scores | Yes |
Supported Frameworks
LangChain, CrewAI, AutoGen, OpenAI, Haystack, LlamaIndex, Semantic Kernel, Google ADK, Claude Agent SDK, and generic RAG pipelines.
Installation
Recommended (14 tools, every language)
Installs the air-blackbox SDK (>=1.17, =1.0, no upper bound.**
mcp 2.0 removed mcp.server.fastmcp and replaced FastMCP with MCPServer.
Rather than pin away from it, the server detects which generation is installed
and binds to the right class, so it runs on 1.x and 2.x alike:
| installed | server class |
|---|---|
| mcp 1.x | FastMCP |
| mcp 2.x | MCPServer |
Both paths are covered by tests that launch python -m air_blackbox_mcp as a
real subprocess and drive it over stdio — the same way Claude Desktop and
Cursor do — and the full suite runs green on both.
**If you are on 0.2.3, upgrade.** That version declared an unpinned
mcp>=1.0.0, so once mcp 2.0 shipped, every fresh install produced a server
that died on import:
0.2.4 fixed it by capping at mcp<2; 0.3.0 removes the cap entirely, so this
server no longer conflicts with anything built for mcp 2.x sharing the same
environment.
Claude Desktop Setup
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
Restart Claude Desktop. The 14 tools will appear automatically.
Claude Code / Cursor Setup
Add to .cursor/mcp.json in your project:
Or add to .claude/mcp.json for Claude Code.
Usage Examples
In Claude Desktop, Claude Code, or Cursor, just ask:
- "Scan this code for EU AI Act compliance"
- "Add a trust layer to this LangChain agent"
- "Check this text for prompt injection"
- "What does Article 12 require?"
- "Generate a compliance report for ~/myproject"