English Français العربية

EU Audit Trail

Official registry Security

Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

Source code Documentation

What can you do with EU Audit Trail?

  • Tamper-evident logging — HMAC-SHA256 hash chain over all events
  • PII scanning — Automatic detection and redaction via Microsoft Presidio (EU patterns)
  • GDPR erasure — Article 17 right-to-erasure support with audit trail
  • Compliance checks — Technical checklist against EU AI Act Articles 12/19 and GDPR Article 30
  • Local-first — All data stays on your machine in a single SQLite file

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package eu-audit-mcp
Claude Code 
claude mcp add eu-audit-trail -e 'AUDIT_CONFIG=<AUDIT_CONFIG>' -- uvx eu-audit-mcp==0.1.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "eu-audit-trail": {
            "command": "uvx",
            "args": [
                "eu-audit-mcp==0.1.1"
            ],
            "env": {
                "AUDIT_CONFIG": "<AUDIT_CONFIG>"
            }
        }
    }
}

Environment variables

  • AUDIT_CONFIG Path to the YAML configuration file

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. eu-audit-mcp
  2. Features
  3. Regulatory context
  4. Quick start
  5. MCP Tools
  6. Configuration
  7. Security
  8. License

eu-audit-mcp

Tamper-evident audit trail MCP server for EU AI Act and GDPR compliance. Designed to be integrated into a local desktop application via stdio transport.

Features

  • Tamper-evident logging — HMAC-SHA256 hash chain over all events
  • PII scanning — Automatic detection and redaction via Microsoft Presidio (EU patterns)
  • GDPR erasure — Article 17 right-to-erasure support with audit trail
  • Compliance checks — Technical checklist against EU AI Act Articles 12/19 and GDPR Article 30
  • Local-first — All data stays on your machine in a single SQLite file

Regulatory context

This server implements technical measures for the following EU regulations:

RegulationArticlesWhat it requires
EU AI Act (2024/1689)Art. 12Automatic recording of events (logs) for high-risk AI systems
Art. 19Retention of automatically generated logs for at least 6 months
GDPR (2016/679)Art. 17Right to erasure of personal data ("right to be forgotten")
Art. 30Records of processing activities, including purposes and data categories

The EU AI Act high-risk obligations enter into force on 2 August 2026.

See LEGAL_REFERENCES.md for the full article texts and a detailed mapping of how each tool addresses each requirement.

Disclaimer: This tool provides a technical checklist, not legal advice. Consult qualified legal counsel for compliance decisions.

Quick start

pip install -e ".[dev]"
Run the server (stdio)
python -m eu_audit_mcp.server
MCP client configuration
{
  "mcpServers": {
    "eu-audit": {
      "command": "python",
      "args": ["-m", "eu_audit_mcp.server"],
      "env": {
        "AUDIT_CONFIG": "./audit_config.yaml"
      }
    }
  }
}
Run tests
pytest tests/

MCP Tools

ToolDescription
log_eventRecord an audit event with automatic PII scanning
log_inferenceLog an LLM inference call (model, tokens, cost)
log_data_accessLog a document/data access event
query_logSearch events by time range, type, session
get_session_traceFull ordered trace of a session
get_statsSummary statistics over a time period
compliance_checkCheck against EU AI Act Art. 12/19 and GDPR Art. 30
execute_erasureGDPR Article 17 right-to-erasure
get_pii_summarySummary of detected PII types (counts only)
verify_chainVerify hash chain integrity

Configuration

Copy the example config and customize:

cp audit_config.example.yaml audit_config.yaml

Set the AUDIT_CONFIG environment variable to point to your config file. Do not commit audit_config.yaml if it contains a chain_secret — it is in .gitignore by default.

Security

See SECURITY.md for the threat model, security measures, and vulnerability reporting.

License

Apache-2.0

Frequently asked questions

What is EU Audit Trail?

Tamper-evident audit trail MCP server for EU AI Act & GDPR compliance.

How do I install EU Audit Trail?

It runs on your machine. In Claude Code: claude mcp add eu-audit-trail -e 'AUDIT_CONFIG=<AUDIT_CONFIG>' -- uvx eu-audit-mcp==0.1.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does EU Audit Trail need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is EU Audit Trail open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains EU Audit Trail?

It is published by jellewas. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.