Scans codebases for usage of Google's AI services and generates EU AI Act compliance reports.
Scans codebases for usage of LangChain and generates EU AI Act compliance reports.
Scans codebases for usage of OpenAI's AI services and generates EU AI Act compliance reports.
Scans codebases for usage of PyTorch and generates EU AI Act compliance reports.
Scans codebases for usage of TensorFlow and generates EU AI Act compliance reports.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@gridwork-aiact scan my current codebase for EU AI Act compliance"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that scans codebases for AI system usage and generates EU AI Act compliance reports.
EU AI Act high-risk deadline: August 2, 2026.
Scans project files for AI libraries, APIs, and frameworks
Detects 30+ AI systems: OpenAI, Anthropic, Google, PyTorch, TensorFlow, HuggingFace, LangChain, and more
Classifies risk level per EU AI Act (unacceptable / high / limited / minimal)
Identifies compliance gaps against Annex III categories
Generates formal inventory documents for compliance records
Counts days until the August 2, 2026 deadline
Related MCP server: EU AI Act Compliance MCP Server
npx gridwork-aiactTool | Description |
| Full scan with risk classification and compliance gap analysis |
| Fast count of AI systems without full analysis |
| Formal EU AI Act inventory document |
| Classify risk for a specific AI system by use case |
{
"mcpServers": {
"gridwork-aiact": {
"command": "npx",
"args": ["-y", "gridwork-aiact"]
}
}
}MIT — Gridwork
Classify the EU AI Act risk level for a specific AI system based on its type and use case. Helps determine which obligations apply.
| Name | Required | Description | Default |
|---|---|---|---|
| use_case | Yes | Description of how the system is used | |
| use_domain | No | The domain where the AI system is deployed | other |
| system_name | Yes | Name of the AI system (e.g., 'OpenAI GPT-4', 'Custom PyTorch model') | |
| processes_personal_data | No | Whether the system processes personal data | |
| makes_decisions_about_people | No | Whether outputs affect decisions about individuals |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It only says 'Classify' without disclosing behavioral traits such as whether it makes external API calls, has side effects, or requires specific authorization. The description does not add context beyond the tool's one-word action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacks structure. It could be improved by front-loading key details or using bullet points. However, it is not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should hint at return values. It mentions determining which obligations apply but does not specify the classification categories (e.g., minimal, limited, high, unacceptable) or any other output details. The description is incomplete for a classification tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all parameters. The description mentions 'type and use case', which loosely maps to 'system_name' and 'use_case', but adds no further semantic value beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb 'Classify' and identifies the resource as 'EU AI Act risk level', which clearly conveys the tool's function. While it distinguishes from siblings like 'quick_check' and 'scan_project', it does not explicitly differentiate them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. The description implies it should be used to classify AI systems, but it does not state when not to use it or mention sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a formal EU AI Act inventory document for a project. Produces a structured inventory suitable for compliance records, covering all detected AI systems with risk classifications and documentation requirements.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the project directory | |
| organization | No | Organization name for the inventory header |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It accurately states the output covers all detected AI systems with risk classifications, but omits behavioral traits such as whether the tool modifies files, requires permissions, or has performance implications. It is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long with no redundant information. It efficiently communicates the tool's purpose and output contents without wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should explain return format or expected output. It mentions a structured inventory but does not specify whether the output is a file path, JSON, or PDF. Usage guidelines are also missing, leaving gaps for new users.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so both parameters (path, organization) are already explained. The description adds minimal extra context beyond what the schema provides, saying the inventory covers all detected systems and risk classifications. This is acceptable but not exceptional.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a formal EU AI Act inventory document, listing specific contents like risk classifications and documentation requirements. It effectively distinguishes this from sibling tools like quick_check and classify_system by focusing on formal document generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description implies a compliance context but does not state when to choose generate_inventory over quick_check or scan_project, nor does it provide any conditions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Quick scan to count AI systems in a project without full compliance analysis. Faster than scan_project.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the project directory |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description bears full burden. It indicates a non-destructive scan but lacks details on permissions, side effects, or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with one parameter, description covers main purpose and speed comparison. Could mention output format but adequate for a quick scan.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and schema already describes 'path' as absolute path. Description adds no extra parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'count' and resource 'AI systems in a project', and distinguishes from sibling 'scan_project' by noting it's faster and avoids full compliance analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context for when to use (quick count) and implies when not (full compliance needed), but doesn't explicitly list alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan a project directory for AI system usage and generate an EU AI Act compliance report. Detects LLM APIs (OpenAI, Anthropic, Google, Mistral, etc.), ML frameworks (PyTorch, TensorFlow, scikit-learn), computer vision, NLP, embeddings, and more. Classifies risk level and identifies compliance gaps against the August 2, 2026 deadline.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the project directory to scan | |
| format | No | Output format | markdown |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. While it explains what the tool detects and outputs, it does not mention whether the operation is read-only, requires network access, or has any side effects. This is a significant gap for a tool that performs a scan.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: three sentences that first state the purpose, then list detection capabilities, and finally describe the output. Every sentence adds value without extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description should provide more detail about the report structure or what the tool returns. It mentions risk level and compliance gaps but not whether it returns a file or response object. For a compliance report generator, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description does not add any additional detail about the parameters beyond what the schema already provides. It does not explain the effect of different format choices or how the path should be specified beyond 'absolute path'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: scanning a project directory for AI system usage and generating an EU AI Act compliance report. It lists specific items detected (LLM APIs, ML frameworks, etc.) and outputs, which distinguishes it from siblings like quick_check or generate_inventory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use this tool (for comprehensive scanning and compliance reporting) but does not explicitly mention when not to use it or compare to alternative sibling tools. The context is sufficient though not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.1.0classify_systemgenerate_inventoryquick_checkscan_projectEach tool has a clearly distinct purpose: quick_check is a fast scan, scan_project is a full scan with report generation, generate_inventory produces a formal document, and classify_system classifies risk level. No overlap.
All tool names follow a consistent verb_noun pattern (quick_check, scan_project, generate_inventory, classify_system). The convention is uniform and predictable.
4 tools is well-scoped for the domain of EU AI Act compliance. Each tool serves a distinct and necessary function without redundancy or excessive granularity.
The tool set covers the core compliance workflow: fast scan, full scan, inventory generation, and risk classification. Minor gaps exist, such as the absence of tools for updating or editing generated inventories, but the essential operations are present.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.
EU AI Act sovereignty scanning. Provider residency, registration status, audit trail support.
Open-source licence risk checks for AI coding agents and dependency trees.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/thegridwork/aiact'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
