AIR Blackbox MCP Server

EU AI Act compliance scanning forClaude Desktop,Claude Code,Cursor, and any MCP-compatible client.

Unlike other compliance scanners that only report problems, AIR Blackbox alsoremediates- generating working code fixes, trust layer integrations, GDPR compliance checks, bias analysis, and full compliance reports. Under the hood, the scanning feeds intoair-trust, a cryptographic audit chain (HMAC-SHA256) with Ed25519 signed handoffs that ensures compliance data integrity.

LangChain, CrewAI, AutoGen, OpenAI, Haystack, LlamaIndex, Semantic Kernel, Google ADK, Claude Agent SDK, and generic RAG pipelines.

Works standalone with just the lightweight built-in scanner.

Full (14 tools with GDPR, bias, validation, and history)

Installs the fullair-blackboxSDK (>=1.13,<2) for advanced compliance features. The floor is the version this package is tested against, and the major cap means a 2.x SDK cannot silently change your findings.

This package supports both MCP SDK generations —mcp>=1.0, no upper bound.

mcp 2.0 removedmcp.server.fastmcpand replacedFastMCPwithMCPServer. Rather than pin away from it, the server detects which generation is installed and binds to the right class, so it runs on 1.x and 2.x alike:

Both paths are covered by tests that launchpython -m air_blackbox_mcpas a real subprocess and drive it over stdio — the same way Claude Desktop and Cursor do — and the full suite runs green on both.

If you are on 0.2.3, upgrade.That version declared an unpinnedmcp>=1.0.0, so once mcp 2.0 shipped, every fresh install produced a server that died on import:

ModuleNotFoundError: No module named 'mcp.server.fastmcp'

0.2.4 fixed it by capping atmcp<2; 0.3.0 removes the cap entirely, so this server no longer conflicts with anything built for mcp 2.x sharing the same environment.

Edit~/Library/Application Support/Claude/claude_desktop_config.json:

{ "mcpServers": { "air-blackbox": { "command": "python3", "args": ["-m", "air_blackbox_mcp"] } } }

Restart Claude Desktop. The 14 tools will appear automatically.

Add to.cursor/mcp.jsonin your project:

{ "mcpServers": { "air-blackbox": { "command": "python3", "args": ["-m", "air_blackbox_mcp"] } } }

Or add to.claude/mcp.jsonfor Claude Code.

In Claude Desktop, Claude Code, or Cursor, just ask:

- "Scan this code for EU AI Act compliance"
- "Add a trust layer to this LangChain agent"
- "Check this text for prompt injection"
- "What does Article 12 require?"
- "Generate a compliance report for ~/myproject"
- "Classify the risk level ofsend_email"
- "Scan this code for GDPR issues" (requires full SDK)
- "Check for bias in this AI model code" (requires full SDK)
- "Can my agent call this shell function?" (requires full SDK)
- "Show me my compliance trends" (requires full SDK)

The fullair-blackboxSDK unlocks 4 additional tools:

- Personal data handling without consent
- Data retention and erasure policies
- Cross-border transfer safeguards
- Data processing agreements

- Disparate impact risk detection
- Protected attribute handling
- Training data bias indicators
- Fairness metric awareness

- Pre-execution approval gates (Article 14)
- ConsentGate policy enforcement
- Risk-based action filtering
- Audit trail generation

Compliance History(compliance_history)

- Track past scan results
- Analyze compliance trends
- Export audit trails
- Monitor improvement over time

For AI-powered analysis beyond regex patterns:

# Install Ollama brew install ollama # Pull the fine-tuned compliance model ollama pull air-compliance-v2 # The analyze_with_model tool will automatically use it

Other MCP compliance tools only scan. AIR Blackbox:
- Scans + Remediates- finds issues across 6 EU AI Act articles AND generates working code fixes
- Analyzes deeply- regex patterns + AI-powered model analysis + prompt injection detection (15 patterns)
- Validates before execution- pre-approval gates and risk classification for agent actions (Article 14)
- Tracks compliance- GDPR checks, bias analysis, full reports, and historical trend monitoring (SDK)

Which engine runs is fixed per tool, not a runtime fallback.Earlier versions of this README described a "try the SDK first, fall back to built-in" pattern. That was never what the code did, and it mattered: a reader could not tell whether two reports came from the same rules. The actual behavior:

So a given tool produces results from the same engine on every install, and there is no silent switch between engines.

Because a compliance finding is only comparable to another if you know what produced it,every machine-readable result carries aprovenanceblock:

{ "findings": [ ... ], "provenance": { "engine": "builtin-rules", "scanner_version": "0.2.4", "ruleset_id": "eu-ai-act-art9-15", "ruleset_version": "cee71577c486", "sdk_version": null } }

- engine—builtin-rulesorair-blackbox-sdk, whichever actually ran.
- ruleset_version— a content hash of the active rules, not a hand-maintained string. Change a regex and it changes by itself; a version someone must remember to bump is one that eventually misreports which rules ran.
- sdk_version— the SDK thatproducedthis result, so it isnullfor built-in results even when the SDK is installed alongside. Reporting a version that contributed nothing would imply its rules ran.

Two reports with the sameengine+ruleset_versionwere produced by byte-identical rules and can be diffed directly. Different values mean the rules moved, and the diff needs that context to be meaningful.

Errors carry provenance too — knowing which version produced an error is as useful as knowing which version produced a finding.

Install[full]to unlock the Tier 5 SDK tools; the base install works standalone.

This MCP server is part of theAIR Blackbox ecosystem:

- air-trustonPyPI- the cryptographic audit chain that backs compliance scanning
- air-blackboxonPyPI- the full compliance SDK and CLI scanner
- airblackbox.ai- the project homepage and docs

- EU AI Act- the regulation
- GDPR- data protection regulation

Remediate vulnerabilities found by Contrast products using LLM and Coding Agent capabilities.