English Français العربية

AI Act Radar

Official registry Government and legal

EU AI Act obligations and updates from ten official sources, incl. the national layer.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http ai-act-radar 'https://mcp.aiactradar.com/mcp/v1' --header 'Authorization: <Bearer <your beta key>. Free during the beta, request one at https://aiactradar.com/#waitlist>'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "ai-act-radar": {
            "type": "http",
            "url": "https://mcp.aiactradar.com/mcp/v1",
            "headers": {
                "Authorization": "<Bearer <your beta key>. Free during the beta, request one at https://aiactradar.com/#waitlist>"
            }
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. aiactradar-examples
  2. What every receiver does
  3. Examples
  4. Try it without signing up
  5. Going to production
  6. License

aiactradar-examples

Reference webhook receivers for AI Act Radar. Each subdirectory is a self-contained, runnable example for one platform.

What every receiver does

  1. Reads the raw request body (signature is over the bytes, not the parsed JSON).
  2. Verifies X-AIAR-Timestamp is within 300 seconds of now.
  3. Verifies X-AIAR-Signature (v1=<hex>) using HMAC-SHA-256 over <timestamp>.<raw_body> in constant time.
  4. Checks an idempotency key (event.id) before doing real work — retries are normal.
  5. Returns 2xx within 5 seconds; otherwise the dispatcher retries with exponential backoff.

The verification is identical across platforms; only the platform glue differs.

Examples

FolderPlatformNotes
cloudflare-workers/Cloudflare WorkersWeb Crypto API, KV for idempotency
vercel-edge/Vercel Edge FunctionsWeb Crypto API, Vercel KV for idempotency
aws-lambda/AWS Lambda + API GatewayNode crypto module, DynamoDB for idempotency
express-node/Plain Express on NodeNode crypto, in-process LRU (replace for prod)
fastify-typescript/Fastify + TSTyped body parser, raw-body capture
deno-deploy/Deno DeployDeno KV for idempotency

Try it without signing up

Each example has a test.sh that signs a sample event with a local secret and posts it to the running receiver. You can run the full loop on your laptop in under five minutes:

cd cloudflare-workers
cp .dev.vars.example .dev.vars   # set AIA_SECRET to anything
npm install && npm run dev       # starts http://localhost:8787
# in another terminal:
bash test.sh                     # posts a signed sample event

Going to production

  • Store AIA_SECRET in your platform's secret manager. Never commit it.
  • Rotate the secret in the AI Act Radar dashboard at least every 90 days.
  • Subscribe to the dispatcher's webhook health channel — bounced deliveries surface there before customers notice.
  • Idempotency stores need a TTL of at least 7 days; the dispatcher retries up to 24h.

License

MIT.

AI Act Radar is operated by ligea GmbH, Karlsruhe. Information only — not legal advice.

Frequently asked questions

What is AI Act Radar?

EU AI Act obligations and updates from ten official sources, incl. the national layer.

How do I install AI Act Radar?

It runs as a remote server. In Claude Code: claude mcp add --transport http ai-act-radar 'https://mcp.aiactradar.com/mcp/v1' --header 'Authorization: <Bearer <your beta key>. Free during the beta, request one at https://aiactradar.com/#waitlist>'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does AI Act Radar need an API key?

Yes. It expects Authorization, which you set in its configuration.

Is AI Act Radar open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains AI Act Radar?

It is published by ligea-gmbh. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.