AI Act Radar

What AI Act Radar MCP server does

The supplied repository contains reference webhook receivers for AI Act Radar rather than documented MCP tools. Each subdirectory is a self-contained example for receiving events from the AI Act Radar dispatcher on a different runtime or hosting platform. The examples show the platform-specific code needed to validate requests and handle retries safely.

The AI Act Radar MCP server material provided here should therefore be understood as webhook integration reference material, not as a documented server exposing agent-callable tools. The current listing describes AI Act Radar as providing EU AI Act obligations and updates from official sources, including the national layer, but the README excerpt focuses on delivery of events to application endpoints.

How it works

Every receiver reads the request body as raw bytes before parsing it. This matters because the signature covers the original body, not a reconstructed JSON representation. The receiver checks that the X-AIAR-Timestamp value is no more than 300 seconds from the current time, then validates the X-AIAR-Signature header.

The signature uses the v1=<hex> format and HMAC-SHA-256 over the string <timestamp>.<raw_body>. Verification is performed in constant time. Before doing application work, the receiver checks the event's event.id as an idempotency key. This protects handlers from repeating work when the dispatcher retries a delivery.

Receivers should return a 2xx response within five seconds. Failed or slow deliveries are retried with exponential backoff, so downstream processing should be designed around repeated delivery attempts.

Setup and configuration

Choose the example matching the deployment target: Cloudflare Workers, Vercel Edge Functions, AWS Lambda with API Gateway, Express on Node, Fastify with TypeScript, or Deno Deploy. The implementation uses the platform's available cryptography and persistence features. For example, Cloudflare uses Web Crypto and KV, AWS Lambda uses Node crypto and DynamoDB, and Deno Deploy uses Deno KV.

For a local test, copy the example's .dev.vars.example to .dev.vars, set AIA_SECRET to a local value, install dependencies, and start the development server. Each example includes a test.sh script that signs a sample event and posts it to the running receiver.

In production, keep AIA_SECRET in the platform's secret manager rather than committing it. The documentation recommends rotating the secret at least every 90 days. Idempotency storage should retain keys for at least seven days because retries may continue for up to 24 hours.

Limitations and notes

The AI Act Radar MCP server has no MCP-specific tools, transport details, client compatibility information, or installation command documented in the supplied README. The Express example uses an in-process LRU for idempotency; the README explicitly indicates that this should be replaced for production use. Operators should also monitor the dispatcher's webhook health channel, where bounced deliveries are reported.