EU AI Act Explorer

npx add-mcp 'https://mcp.euaiactlaw.com/mcp'

MCP server

The EU AI Act Explorer exposes the same official-text data to AI assistants through a free, read-only MCP (Model Context Protocol) server. It answers from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, always citing the Official Journal source. It provides legal information, not legal advice.

Endpoint: https://mcp.euaiactlaw.com/mcp - plain JSON-RPC 2.0 over HTTPS POST, supporting protocol versions 2026-07-28 and 2025-03-26 (legacy). No account, no API key, no authentication. GET is not used; a plain HTTPS POST works directly.

Something wrong or missing? AI clients can report it with the send_feedback tool.

Generic client configuration:

{"mcpServers": {"eu-ai-act": {"url": "https://mcp.euaiactlaw.com/mcp"}}}

Test it now (no install, no account): Open this server in Glama's hosted MCP Inspector and click Connect - you can call all 9 tools straight from your browser. Verified working 22 October 2026.

Tools (9: eight read-only lookups, plus send_feedback)

Tool	Required arguments	What it returns
get_article	number	Full article text with citation
get_recital	number	Full recital text
get_annex	number (Roman numeral)	Full annex text
get_definition	term	Article 3 definition with reference
search_text	query	Ranked matching passages with article references
get_obligations	role (provider, deployer,...)	Obligation list mapped to application phases
get_deadlines	(none)	Application timeline as of today, with in-force status
assess_compliance	answers keyed by step id (E1 roles required, plus S1, R1-R5, HR1-HR6 as applicable)	Full compliance assessment: roles, risk classification, obligation list with legal basis and deadlines (same decision tree as the interactive checker)
send_feedback	category, message	Records a feedback message for the maintainer (the only tool that writes anything; no reply)

Roles accepted by get_obligations: provider, deployer, importer, distributor. These are the Article 3 operators the obligation data covers today. Optional risk_tier filter: unacceptable, high, transparency, minimal (maps to the Obligation Matrix's scenario risk classes). One role per call; an entity can hold several roles at once (Recital 83), so call once per role. GPAI-specific provider obligations are included in the provider results.

Fictional worked example

An agent helping a fictional startup, "Acme Hiring" (made up for this example), checks first duties for a CV-screening tool. Two real calls and their real outputs:

1. search_text({query: "recruitment or selection of natural persons"}) returns, verbatim:

1. Article 3 - Definitions
   For the purposes of this Regulation, the following definitions apply: (1) 'AI system' means a machine-based system that is designed to operate with varying levels of autonomy and t...
2. Article 5 - Prohibited AI practices
   1. The following AI practices shall be prohibited: (a) the placing on the market, the putting into service or the use of an AI system that deploys ...

2. get_obligations({role: "deployer"}) returns, verbatim:

Obligations for role "deployer" (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026):
1. Ensure staff and contractors have a sufficient level of AI literacy
   - Article 4, "AI literacy" - In force since 2 Feb 2025; current wording applies from 27 Jul 2026
   - https://euaiactlaw.com/article/4
2. Immediately stop using and withdraw any AI system performing a prohibited practice
   - Article 5, "Prohibited AI practices" - In force since 2 Feb 2025; points (ba)-(bb) apply from 2 Dec 2026
   - https://euaiactlaw.com/article/5
3. Use system in accordance with instructions of use
   - Article 26(1), "Obligations of deployers of high-risk AI systems" - Applies from 2 Dec 2027 (Annex III systems) / 2 Aug 2028 (Annex I-embedded systems)
   - https://euaiactlaw.com/article/26
... (17 more obligations in the live response)

The example is fictional; the outputs are real server responses from 22 October 2026.

Fair use: free tier; automated clients should keep request rates modest (a zone rate limit applies). The server stores no queries and answers only from the official texts.

Privacy: We record aggregate MCP usage statistics through Cloudflare. Feedback submitted through the MCP service is retained for 90 days. Cloudflare processes connection data to deliver and protect the service, and network data for its own security purposes. See Cloudflare Privacy Policy. Questions: yiango@proton.me

Protocol notes

The server is dual-era: it speaks the current MCP revision (2026-07-28, per-request _meta protocol fields, MCP-Protocol-Version / Mcp-Method / Mcp-Name headers, server/discover) and the legacy initialize-handshake revisions (2025-03-26 through 2025-11-25), selected per request. server/discover lists the supported versions.

Two deliberate deviations from a strict reading of the 2026-07-28 spec:

• Origin header: the spec's Origin validation exists to stop DNS-rebinding attacks on localhost servers. This is a public read-only remote server, so that attack does not apply; any https Origin is accepted and non-https Origins are rejected.
• GET on the endpoint: a browser GET to the MCP endpoint redirects (302) to this documentation page instead of returning 405, so humans who paste the URL land somewhere useful. API clients only ever POST.