Bidda Compliance MCP Server

by bidda Your server? Claim it

answering

Bidda Compliance is answering right now. Last checked 5 min ago. It exposes 25 tools.

10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).

Uptime history 47 days of history

47 days agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

109 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 15

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 18 August 2026. No other catalogue keeps this.

25 Aug 12 tools changed the parameters they ask for compare_jurisdictions, consult_node, create_attestation and 9 more

25 Aug a tool changed version

21 Aug a tool description was rewritten list_pillars

18 Aug a tool description was rewritten list_pillars

Nothing serious here today

Today is the operative word: we check Bidda Compliance every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 5 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add bidda-compliance --transport http https://bidda.com/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "bidda-compliance": {
      "url": "https://bidda.com/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.bidda-compliance]
url = "https://bidda.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "bidda-compliance": {
      "url": "https://bidda.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "bidda-compliance": {
      "url": "https://bidda.com/mcp"
    }
  }
}

Available tools 25

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

action

check_action_compliance

Pre-flight regulatory check. Agent describes an intended action in natural language ("process EU resident biometric data", "transfer health records to a third-party AI vendor", "deploy autonomous trading model in Singapore") and receives a ranked list of regulations that may apply, plus a risk indicator (LOW/MODERATE/HIGH). The primary tool for runtime compliance gating in autonomous agent workflows.

attestation

create_attestation

Create a signed, time-stamped record of which Bidda rules a person or AI agent relied on for a decision. Returns a record ID and a public verify URL so anyone can later confirm the record has not been changed. Useful for agents that must keep an audit trail of what they checked. Requires an active Bidda subscription: pass api_key.

audit

get_audit_pack

Export a run as a governance evidence pack: the signed receipt, every entry, a roll-up of the nodes consulted (with pinned versions/hashes), an independent hash-chain + Merkle integrity self-check, and a coversheet mapping the receipt to the record-keeping obligations it supports (EU AI Act Art. 12/26, ISO/IEC 42001, NIST AI RMF). A sealed run is readable by id; a still-open run's draft pack needs your api_key.

browse

browse_topics

Browse the registry by cross-cutting compliance TOPIC (for example data breach notification, AI transparency, AML and KYC). Returns each topic with how many rules carry it and across how many pillars and jurisdictions. Topics sit on top of the 39 pillars without replacing them. Free, no key required. Pass a topic string to drill into one.

compare

compare_jurisdictions

Compare how different jurisdictions address a compliance topic, side by side, including where their numeric thresholds differ (for example a breach-notification deadline of 72 hours versus 30 days). It surfaces the real rules and numbers and does not rank which jurisdiction is stricter. Requires an active Bidda subscription: pass your key as api_key.

consult

consult_node

The one-call governed turn: fetch the full vault node (this consumes one call on your key, exactly like unlocking a node) AND record a verified node_consulted entry for it on an open run, in a single step. The entry pins the node to its current version + integrity hash, so the run receipt proves what the agent actually consulted. Use this instead of get_node when you are inside a run. Requires an active Bidda subscription: pass api_key.

control

create_control_attestation

Sign a tamper-evident record of one of YOUR OWN controls or policies and the Bidda obligation nodes it maps to. Each obligation is pinned to its current version + integrity hash at signing time, so the record shows what the control was mapped against on that date. This is the design-side evidence ('we operate this control, mapped to these obligations'); run receipts are the operating-side evidence. Requires an active Bidda subscription: pass api_key.

crosswalk

get_crosswalk

Return the cross-framework mapping dimensions for a node: which other regulations, standards, or jurisdictions this rule maps to (e.g. GDPR Article 17 → CCPA right-to-delete → POPIA Section 24). Discovery returns the available dimensions; full mapping values are vault-gated.

dependency

get_dependency_chain

Walk the prerequisite chain for a compliance node. Given one node, returns its full dependency tree (the prior obligations an agent must satisfy before this one applies). Use this to plan a complete compliance posture: unlocking one node usually requires understanding 3-8 upstream nodes. Defaults to depth 2; max 4.

drift

drift_check

Check whether the compliance rules an agent has cached in its own memory are still current. Submit the node_id and the integrity hash you stored when you last grounded on each rule; get back, per rule, whether it is fresh, has drifted (content changed), or was withdrawn (instrument repealed) - so the agent re-grounds before acting on stale law. Included with every API tier; the per-call batch size scales with your plan. Pass api_key.

gap

gap_check

Given the compliance rules a team says it covers, return the prerequisite rules Bidda's dependency graph links to them that were NOT listed - the 'you missed the prerequisite obligation' gaps - plus any covered rule the registry marks withdrawn. A coverage aid for a qualified reviewer; it does not rank or determine compliance. Requires an active Bidda subscription: pass api_key.

get

get_run

Fetch a run and its entries. The owner can read an open or sealed run (pass api_key); a sealed run is also publicly readable by id and reports whether its signature is valid.

jurisdiction

get_jurisdiction_bundle

Return all compliance nodes that apply in a specific jurisdiction (EU, US, UK, Australia, Singapore, India, Canada, China, South Africa, Japan, Brazil and others). Use when an agent enters a new market and needs the full regulatory surface for that geography.

latest

get_latest_changes

List the most recently updated compliance nodes: the regulatory change feed. Use to monitor incoming amendments, new guidance, or freshly added rules. Filter by pillar to focus on a domain. Agents should call this on a schedule to keep compliance posture current.

mitre

get_mitre_mapping

The MITRE Rosetta Stone. Given a MITRE technique ID across 5 frameworks (ATT&CK Enterprise, ATT&CK Mobile, ATT&CK ICS, D3FEND, ATLAS), return the Bidda node for that technique plus its mapped compliance obligations: NIST 800-53 controls, ISO 27001 Annex A clauses, PCI DSS requirements, NIS2 articles, HIPAA Security Rule, DORA articles, NERC CIP, IEC 62443. The bridge between how SOC teams think (technique IDs) and how compliance teams think (control families). Free.

node

get_node

Get a specific compliance node by its ID. Returns the node summary: title, compliance pillar, version, last updated, and BLUF. The full node (machine-executable deterministic workflow, actionable schema, primary legal citations, dependency chain) is available at bidda.com.

nodes

search_nodes

Search Bidda compliance nodes by keyword. Returns matching node summaries including a one-sentence BLUF (Bottom Line Up Front): the exact compliance obligation in plain language. Every node traces to a primary legal source (no hallucination). Examples: "Basel III capital", "GDPR data breach", "AML transaction monitoring", "SOC 2 Type II".

obligation

obligation_deltas

The obligation-level change feed: primary sources whose content changed (or whose node was withdrawn), mapped to the Bidda obligation nodes they affect, filterable by time, pillar, or specific nodes. Use it to answer 'what obligations changed since I last reviewed?'. Requires an active Bidda subscription: pass api_key.

open

open_run

Open a run ledger: a signed, tamper-evident log of what an agent does across a whole task or conversation (for example a support-bot chat). Returns a run_id. Record one entry per turn with record_run_entry, then seal_run to get a single signed Run Receipt. Requires an active Bidda subscription: pass api_key.

oscal

oscal_assessment_results

Export a governed run's evidence as a NIST OSCAL assessment-results document (the machine-readable format GRC and audit tooling consumes): reviewed-controls (the obligation nodes consulted), observations (each pinned to its version + integrity hash), and props recording the independent integrity self-check. A sealed run is readable by id; a still-open run needs your api_key.

pillars

list_pillars

List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 10,099 cryptographically-verified nodes across 39 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.

point

point_in_time

Get a signed record of which committed version of a rule was authoritative at a specific past date, anchored to the public history chain. Useful when an agent must show what a rule said at the moment it acted. Requires an active Bidda subscription: pass api_key.

record

record_run_entry

Append one entry to an open run: which Bidda rules the agent consulted, what it decided, and the end user's input (as text via note, or privately as input_hash). Each entry is hash-chained to the previous one. Requires an active Bidda subscription: pass api_key.

seal

seal_run

Seal an open run into one signed Run Receipt covering every entry, with a public verify URL. Idempotent: sealing an already-sealed run returns the same receipt. Requires an active Bidda subscription: pass api_key.

watch

watch_changes

Subscribe to regulatory change alerts: watch specific rules and/or whole pillars and get notified by email or webhook when their primary source changes. Requires an active Bidda subscription: pass api_key.

Endpoints

URL	Transport	State	Latency	Checked
https://bidda.com/mcp	streamable-http	answering	128 ms	5 min ago

Alternatives to Bidda Compliance

same job, measured the same way

EU Audit Trail

by jellewas

Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

72 installs/wk local only

MCP Agentcore

by geiant

AI governance MCP server for EU AI Act compliance and jurisdiction verification

3 tools answering

Meok Enterprise Compliance Suite

by csoai-org

MEOK Enterprise Compliance Suite — End-to-end EU AI Act, GDPR, NIS2, DORA, ISO, SOC2, HIPAA, PCI

103 installs/wk local only

Eu AI Act Compliance MCP

by csoai-org

Eu Ai Act Compliance MCP Server by MEOK AI Labs

376 installs/wk local only

Attestix

by vibetensor

AI agent identity, W3C credentials, EU AI Act compliance. 47 MCP tools.

242 installs/wk local only

ContinueOps Public MCP

by continueops

BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.

7 tools answering

Gdpr Compliance AI MCP

by csoai-org

Gdpr Compliance Ai MCP Server by MEOK AI Labs

370 installs/wk local only

Agent Broker

by hatchloop

23 MCP tools: compliance, verification, messaging, booking, US contracts. 15 need no key.

23 tools answering

Bidda Compliance — questions

Answers built from our own checks of this server.

What can Bidda Compliance do?

It exposes 25 tools, read directly from the server on our last check. Among them: browse_topics, check_action_compliance, compare_jurisdictions, consult_node, create_attestation, create_control_attestation and 19 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Bidda Compliance working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 109 ms. The bar chart above shows every period we have measured.

How do I connect Bidda Compliance?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Bidda Compliance need an API key?

No. Bidda Compliance completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 25 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Bidda Compliance?

It answers our handshake in 109 ms on average, which is faster than 82% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.