Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "vitna-compliance-preflight": {
      "type": "http",
      "url": "https://vitna.costrinity.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
      }
    }
  }
}

claude mcp add --transport http vitna-compliance-preflight https://vitna.costrinity.xyz/api/mcp --header "Authorization: Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"

[mcp_servers.vitna-compliance-preflight]
url = "https://vitna.costrinity.xyz/api/mcp"
bearer_token_env_var = "VITNA_COMPLIANCE_PREFLIGHT_TOKEN"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vitna-compliance-preflight": {
      "type": "remote",
      "url": "https://vitna.costrinity.xyz/api/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "vitna-compliance-preflight": {
      "type": "http",
      "url": "https://vitna.costrinity.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=vitna-compliance-preflight&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdml0bmEuY29zdHJpbml0eS54eXovYXBpL21jcCIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciAke1ZJVE5BX0NPTVBMSUFOQ0VfUFJFRkxJR0hUX1RPS0VOfSJ9fQ%3D%3D"
}

{
  "servers": {
    "vitna-compliance-preflight": {
      "type": "http",
      "url": "https://vitna.costrinity.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "vitna-compliance-preflight": {
      "httpUrl": "https://vitna.costrinity.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
      }
    }
  }
}

extensions:
  "vitna-compliance-preflight":
    enabled: true
    name: "vitna-compliance-preflight"
    type: streamable_http
    uri: "https://vitna.costrinity.xyz/api/mcp"
    headers:
      "Authorization": "Bearer ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}"
    timeout: 300

Placeholders to fill from your own secret store: ${VITNA_COMPLIANCE_PREFLIGHT_TOKEN}. The registry never accepts secret values.

Quality 83 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene71 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: vitna_claim (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); consent_check (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); breach_classify (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
pass
tools.token_costabout 3,099 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changes2 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependencies100 · weight 15

pass
deps.known_vulnsno known advisory in 1 resolved packages
n/a
deps.mcp_sdk_versionthe official MCP SDK is not in the dependency graph
pass
deps.resolvable@costrinity/[email protected] resolved: 1 packages

23 tools, about 3,099 tokens to load them all · tool set 9b3bb11012f3 · tools last changed 2026-10-05 · checked 2026-10-19 18:29 UTC

Tool changes

2026-10-05vitna_claimchangeddescription
before
Ask whether this VITNA account has been claimed by a real person yet, and get the link that claims it. Call this when the user asks about their VITNA account, when you are told evidence is not being kept, or any time you want to hand the user something actionable. Returns { claimed, claim_url, what_claiming_gets_you }. IMPORTANT: if claimed is false, show the user the claim_url verbatim -- it is a one-time link that only they can act on, the account's evidence is NOT being durably recorded until they do, and they cannot find this link anywhere else. Do not paraphrase the URL and do not withhold it.
after · 51% of words in common
Ask whether this VITNA account has been claimed by a real person yet. Call this when the user asks about their VITNA account or when you are told evidence is not being kept. Returns { claimed, claim_url: null, claim_note, what_claiming_gets_you }. You are never given the claim link, and you must not look for it: only a person may claim the account that oversees you. If claimed is false, tell the user that the account's evidence is NOT being durably recorded and that they can claim it with the claim link VITNA showed them when the trial started (the stdio server prints it in its MCP server log).
2026-10-05privacy_notice_getchangeddescription
before
Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Stateless generator: records no decision and leaves no dashboard timeline trace.
after · 56% of words in common
Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Called with an API key, the operator's name and contact details appear as placeholders; the signed-in owner gets the real values. Stateless generator: records no decision and leaves no dashboard timeline trace.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 100 / 100

provenance100

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +dns-namespace +website +reachable +uptime-100% +updated-8d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@costrinity/[email protected] npm0 dependencies, resolved · advisories checked 2026-10-19

No known advisory affects this dependency graph.

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://vitna.costrinity.xyz/api/mcp` streamable-http	none	yes	100%	913 ms	2025-03-26	2026-10-19

package	registry	version	runtime	secrets
`@costrinity/vitna-compliance-mcp`	npm	0.5.6	–	`VITNA_API_KEY`

Tools (23)

`aadhaar_mask`	Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless validator: records no decision and leaves no dashboard timeline trace.
`ai_act_classify`	Before you build or ship an AI feature, check where it lands under the EU AI Act (Regulation 2024/1689). Describe the use case (with biometric / remote-identification / automated-decision / social-scoring / GPAI flags) and VITNA returns the risk tier (prohibited / high-risk / limited-risk / minimal-risk), GPAI obligations, and the per-tier obligations you would have to meet. A classification for you to act on: VITNA evaluates and records, it does not gate the build.
`breach_classify`	After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts (affected count, data categories, sensitivity, recovery state) and VITNA returns reportability + reasoning + the notification deadline + who to notify, across DPDP §8, GDPR Art 33, CPRA §1798.82, LGPD Art 48, PDPA §26B, and US-FED sectoral. This makes the full incident decision from the facts; for a quick per-US-state deadline/recipient/threshold table without incident facts, use us_state_breach_deadline. VITNA evaluates and records; acting on the result is up to you.
`consent_check`	Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and optional category); returns { allowed, reason, matching_consent_id, principal_id }, a determination you must honour yourself since VITNA evaluates and records but does not enforce. Use this for personal-data processing legality; for a dangerous technical action (shell / file / DB / network) use vitna_preflight instead.
`cpf_validate`	Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.
`dpia_threshold_check`	Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categories (and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags); returns dpia_required + the 9-criterion WP29 analysis + jurisdiction guidance, so you know whether to pause and assess before proceeding.
`global_compliance_map`	Master catalogue of every privacy/security/sectoral regime VITNA has fabric for (28 entries covering 24 named statutes). Stateless lookup: records no decision and leaves no dashboard timeline trace.
`gstin_validate`	Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.
`iban_validate`	Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.
`india_cross_border_status`	Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code (e.g. US). Stateless lookup: records no decision and leaves no dashboard timeline trace.
`india_regulators_directory`	Static reference directory of Indian data and sector regulators (DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA), optionally filtered by sector: a lookup of who exists and what they cover. To instead work out which of them apply to a specific processing activity, use india_sectoral_check. Stateless lookup: records no decision and leaves no dashboard timeline trace.
`india_sectoral_check`	Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PFRDA) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a plain directory of every Indian regulator regardless of your activity, use india_regulators_directory.
`japan_cross_border_status`	Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.
`pan_classify`	Classify a PAN entity type from the 4th character (P=Person, C=Company, H=HUF, F=Firm, ...). Stateless validator: records no decision and leaves no dashboard timeline trace.
`pii_test`	Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether severity would escalate. Nothing is persisted and nothing is filtered: a safe rehearsal you act on, not an enforced gate — it records no decision and leaves no dashboard timeline trace.
`privacy_notice_get`	Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Called with an API key, the operator's name and contact details appear as placeholders; the signed-in owner gets the real values. Stateless generator: records no decision and leaves no dashboard timeline trace.
`sin_validate`	Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.
`sub_processors_register`	Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.
`us_sectoral_check`	Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india_sectoral_check.
`us_state_breach_deadline`	Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold (e.g. 'CA' gives 500 residents, CA AG, without unreasonable delay). This is a static table, not an incident ruling. When you have the actual incident facts and need a reportable / not-reportable decision with reasoning, use breach_classify instead. Stateless lookup: records no decision and leaves no dashboard timeline trace.
`vitna_claim`	Ask whether this VITNA account has been claimed by a real person yet. Call this when the user asks about their VITNA account or when you are told evidence is not being kept. Returns { claimed, claim_url: null, claim_note, what_claiming_gets_you }. You are never given the claim link, and you must not look for it: only a person may claim the account that oversees you. If claimed is false, tell the user that the account's evidence is NOT being durably recorded and that they can claim it with the claim link VITNA showed them when the trial started (the stdio server prints it in its MCP server log).
`vitna_help`	What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check risky actions BEFORE running them, what a deny / hold decision means, trial vs claimed mode, and how the user can monitor and audit what you do. Runs entirely locally: no account, no API call, and no dashboard timeline trace.
`vitna_preflight`	SAFETY / OVERSIGHT CHECK before a dangerous or destructive action (shell command, file deletion, DB statement, network call). Call this to have VITNA check the action BEFORE you run it: it flags dangerous shell / SQL / secret-exfil / prompt-injection / suspicious-network patterns and returns { decision: allowed\|blocked\|flagged }. RESPONSE SHAPE DEPENDS ON THE KEY: an unclaimed trial key gets the decision label only, because the pattern detail is what makes the classifier worth stealing. A claimed key additionally gets threat_category, severity, reason (the rule names that matched, never the matched text), a threats[] array and a redacted echo of what was scanned, plus a signed audit record the user can review. VITNA evaluates and records; it does NOT enforce, so treat blocked / flagged as a stop and get human approval. This is how a user keeps you in check. Heuristic pattern match, not a sandbox: novel or obfuscated payloads can pass.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "xyz.costrinity/vitna-compliance-preflight",
  "title": "VITNA – Containment for rogue AI agents",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://vitna.costrinity.xyz/api/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "Authorization",
          "isSecret": true,
          "description": "Bearer <your VITNA API key>. Discovery (initialize, tools/list) and vitna_help work without it; every governed decision tool requires it. Get a key free at https://vitna.costrinity.xyz/dashboard. X-API-Key is also accepted."
        }
      ]
    }
  ],
  "version": "0.5.6",
  "packages": [
    {
      "version": "0.5.6",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@costrinity/vitna-compliance-mcp",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "VITNA_OWNER_ID",
          "description": "Your VITNA operator UUID. Optional: if unset, the first tool call self-provisions a restricted trial key. The old VIGIL_OWNER_ID name is still accepted."
        },
        {
          "name": "VITNA_API_KEY",
          "isSecret": true,
          "description": "Your VITNA API key (new keys vitna_..., legacy vigil_... keys remain valid). Optional: self-provisioned if unset. The old VIGIL_API_KEY name is still accepted."
        },
        {
          "name": "VITNA_EMAIL",
          "description": "Email to own the self-provisioned trial account. Optional: a throwaway is used if unset. It does not claim the account: claim it with GitHub or a passkey. The old VIGIL_EMAIL name is still accepted."
        },
        {
          "name": "VITNA_BASE_URL",
          "default": "https://vitna.costrinity.xyz",
          "description": "VITNA base URL; override only for self-hosted. The old VIGIL_BASE_URL name is still accepted."
        },
        {
          "name": "VITNA_OPEN_CLAIM",
          "description": "Set to 1 to have the trial's claim link opened in your default browser when a trial starts. Either way the link is printed in the MCP server log, and the agent is never sent it."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/COSTRINITY/vitna-compliance-mcp",
    "source": "github"
  },
  "websiteUrl": "https://vitna.costrinity.xyz",
  "description": "Guard wraps stdio MCP servers: risky calls wait for a person; no answer, no run. Remote: cooperative"
}