VITNA — Agent Compliance Preflight is answering right now. Last checked 7 min ago. 123 installs a week from npm. It exposes 23 tools. Last commit 20 Aug 2026.
Pre-action allow/deny for AI agents. 24 statutes, 13 jurisdictions: EU AI Act, GDPR, DPDP.
Installs per day
peak 307 · avg 39 · -79% w/w
a month agotoday
Uptime history
21 days of history
21 days agonow
100.0%
Uptime 24h
91 of 91 checks
23
Tools
read from the server
1016 ms
Response time
average over 24h
123
Installs / week
npm and PyPI
What the code does
We read the source, 14 h ago · tools taken from the live server · rules 3dff92dd89df
Evidence
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
Deletes files or strips permissions
src/tools.ts:349
action: { type: 'string', description: 'The proposed action / command text, e.g. "rm -rf /" or "DROP TABLE users".' },
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch VITNA — Agent Compliance Preflight and you get told the day something new turns up.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 7 min ago.
run in your terminal
claude mcp add vitna-compliance-preflight --transport http https://vitna.costrinity.xyz/api/mcp~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"vitna-compliance-preflight": {
"url": "https://vitna.costrinity.xyz/api/mcp"
}
}
}~/.codex/config.toml
[mcp_servers.vitna-compliance-preflight]
url = "https://vitna.costrinity.xyz/api/mcp".cursor/mcp.json
{
"mcpServers": {
"vitna-compliance-preflight": {
"url": "https://vitna.costrinity.xyz/api/mcp"
}
}
}.vscode/mcp.json
{
"mcpServers": {
"vitna-compliance-preflight": {
"url": "https://vitna.costrinity.xyz/api/mcp"
}
}
}Available tools 23
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
india
india_cross_border_status
Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code (e.g. US). Stateless lookup: records no decision and leaves no dashboard timeline trace.
india_regulators_directory
Static reference directory of Indian data and sector regulators (DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA), optionally filtered by sector: a lookup of who exists and what they cover. To instead work out which of them apply to a specific processing activity, use india_sectoral_check. Stateless lookup: records no decision and leaves no dashboard timeline trace.
india_sectoral_check
Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PFRDA) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a plain directory of every Indian regulator regardless of your activity, use india_regulators_directory.
vitna
vitna_claim
Ask whether this VITNA account has been claimed by a real person yet, and get the link that claims it. Call this when the user asks about their VITNA account, when you are told evidence is not being kept, or any time you want to hand the user something actionable. Returns { claimed, claim_url, what_claiming_gets_you }. IMPORTANT: if claimed is false, show the user the claim_url verbatim -- it is a one-time link that only they can act on, the account's evidence is NOT being durably recorded until they do, and they cannot find this link anywhere else. Do not paraphrase the URL and do not withhold it.
vitna_help
What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check risky actions BEFORE running them, what a deny / hold decision means, trial vs claimed mode, and how the user can monitor and audit what you do. Runs entirely locally: no account, no API call, and no dashboard timeline trace.
vitna_preflight
SAFETY / OVERSIGHT CHECK before a dangerous or destructive action (shell command, file deletion, DB statement, network call). Call this to have VITNA check the action BEFORE you run it: it flags dangerous shell / SQL / secret-exfil / prompt-injection / suspicious-network patterns and returns { decision: allowed|blocked|flagged, threat_category, reason } plus (in claimed mode) a signed audit record the user can review. VITNA evaluates and records; it does NOT enforce, so treat blocked / flagged as a stop and get human approval. This is how a user keeps you in check. Heuristic pattern match, not a sandbox: novel or obfuscated payloads can pass.
aadhaar
aadhaar_mask
Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless validator: records no decision and leaves no dashboard timeline trace.
act
ai_act_classify
Before you build or ship an AI feature, check where it lands under the EU AI Act (Regulation 2024/1689). Describe the use case (with biometric / remote-identification / automated-decision / social-scoring / GPAI flags) and VITNA returns the risk tier (prohibited / high-risk / limited-risk / minimal-risk), GPAI obligations, and the per-tier obligations you would have to meet. A classification for you to act on: VITNA evaluates and records, it does not gate the build.
breach
breach_classify
After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts (affected count, data categories, sensitivity, recovery state) and VITNA returns reportability + reasoning + the notification deadline + who to notify, across DPDP §8, GDPR Art 33, CPRA §1798.82, LGPD Art 48, PDPA §26B, and US-FED sectoral. This makes the full incident decision from the facts; for a quick per-US-state deadline/recipient/threshold table without incident facts, use us_state_breach_deadline. VITNA evaluates and records; acting on the result is up to you.
consent
consent_check
Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and optional category); returns { allowed, reason, matching_consent_id, principal_id }, a determination you must honour yourself since VITNA evaluates and records but does not enforce. Use this for personal-data processing legality; for a dangerous technical action (shell / file / DB / network) use action_preflight instead.
cpf
cpf_validate
Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.
dpia
dpia_threshold_check
Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categories (and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags); returns dpia_required + the 9-criterion WP29 analysis + jurisdiction guidance, so you know whether to pause and assess before proceeding.
global
global_compliance_map
Master catalogue of every privacy/security/sectoral regime VITNA has fabric for (28 entries covering 24 named statutes). Stateless lookup: records no decision and leaves no dashboard timeline trace.
gstin
gstin_validate
Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.
iban
iban_validate
Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.
japan
japan_cross_border_status
Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.
pan
pan_classify
Classify a PAN entity type from the 4th character (P=Person, C=Company, H=HUF, F=Firm, ...). Stateless validator: records no decision and leaves no dashboard timeline trace.
pii
pii_test
Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether severity would escalate. Nothing is persisted and nothing is filtered: a safe rehearsal you act on, not an enforced gate — it records no decision and leaves no dashboard timeline trace.
privacy
privacy_notice_get
Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Stateless generator: records no decision and leaves no dashboard timeline trace.
sectoral
us_sectoral_check
Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india_sectoral_check.
sin
sin_validate
Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.
state
us_state_breach_deadline
Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold (e.g. 'CA' gives 500 residents, CA AG, without unreasonable delay). This is a static table, not an incident ruling. When you have the actual incident facts and need a reportable / not-reportable decision with reasoning, use breach_classify instead. Stateless lookup: records no decision and leaves no dashboard timeline trace.
sub
sub_processors_register
Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://vitna.costrinity.xyz/api/mcp | streamable-http | answering | 1478 ms | 7 min ago |
Alternatives to VITNA — Agent Compliance Preflight
same job, measured the same way
D
Skowron Compliance Gateway
by workers-mattskowronis-skowron-compliance-gateway
OFAC, LEI, EU VAT, AI Act, and company compliance preflight for agents.
MCP Agentcore
by geiant
AI governance MCP server for EU AI Act compliance and jurisdiction verification
I
Dropcoin Validation
by freshfos
EU compliance checks for AI agents: sanctions, company, VAT ID, IBAN, email. Pay per call.
Air Blackbox MCP
by airblackbox
EU AI Act compliance scanner for Python AI agents. 14 tools across 6 articles.
Cra Compliance MCP
by csoai-org
EU Cyber Resilience Act (Regulation 2024/2847) compliance for AI agents. Product classification...
EU Audit Trail
by jellewas
Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.
Air Blackbox
by shotwellj
EU AI Act compliance scanner for Python AI agents — scan, analyze, and remediate
O
LexLint: compliance lint for AI, scraping, and privacy law
by lexlint
Compliance lint for AI, scraping, and privacy law. Cited findings in 200 or more jurisdictions.
VITNA — Agent Compliance Preflight — questions
Answers built from our own checks of this server.
What can VITNA — Agent Compliance Preflight do?
It exposes 23 tools, read directly from the server on our last check. Among them: aadhaar_mask, ai_act_classify, breach_classify, consent_check, cpf_validate, dpia_threshold_check and 17 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README.
How MCP servers expose tools in the first place →
What is VITNA — Agent Compliance Preflight mostly used for?
Its tools cluster around india and vitna. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.
Is VITNA — Agent Compliance Preflight working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 1016 ms. The bar chart above shows every period we have measured.
How do I connect VITNA — Agent Compliance Preflight?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does VITNA — Agent Compliance Preflight need an API key?
No. VITNA — Agent Compliance Preflight completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 23 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is VITNA — Agent Compliance Preflight?
It answers our handshake in 1016 ms on average, which is faster than 8% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use VITNA — Agent Compliance Preflight?
The npm package @costrinity/vitna-compliance-mcp was installed 123 times in the last week. Week over week that is -79%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is VITNA — Agent Compliance Preflight open source?
Yes — it is published under the MIT licence, written in TypeScript, 0 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.