Air Blackbox MCP

What airblackbox/air-blackbox-mcp MCP server does

The airblackbox/air-blackbox-mcp MCP server exposes compliance checks for Python applications that use AI-agent frameworks and model APIs. It scans code strings, individual Python files, or complete directories, then reports findings related to six EU AI Act articles. Supported frameworks include LangChain, CrewAI, AutoGen, OpenAI, Haystack, LlamaIndex, Semantic Kernel, Google ADK, Claude Agent SDK, and generic RAG pipelines.

The server is designed to go beyond detection. Its remediation tools can suggest article-specific changes and generate trust-layer integration code. It can also explain EU AI Act articles and produce a Markdown compliance report. Prompt injection checks cover 15 patterns, while risk classification evaluates tools against EU AI Act risk levels.

How it works

The base tools always use the built-in rule-based scanner. They do not switch to the SDK when the SDK happens to be installed. The optional GDPR, bias, action-validation, and compliance-history tools always use the air-blackbox SDK and return an explicit installation error if that dependency is unavailable.

Results include provenance describing the engine, scanner version, ruleset identifier, ruleset version, and SDK version when applicable. This makes results easier to compare: reports produced by the same engine and ruleset version come from identical rules, while changes in those values provide context for interpreting differences.

For deeper analysis, analyze_with_model can use the locally installed Ollama model air-compliance-v2. Ollama is optional and is not required for the built-in scanner. The MCP implementation supports MCP SDK 1.x and 2.x by selecting the appropriate server class at runtime.

Setup and configuration

Install the base distribution with:

pip install air-blackbox-mcp

This provides the ten tools that do not require the full SDK. To enable GDPR scanning, bias analysis, action validation, and compliance history, install:

pip install air-blackbox-mcp[full]

The full extra installs the air-blackbox SDK with a declared range of >=1.13,<2. Launch the server over stdio with python3 -m air_blackbox_mcp. Claude Desktop and Cursor configurations use that command with no server URL or credential setting. The README also documents the same command for Claude Code.

Tools and capabilities

The airblackbox/air-blackbox-mcp MCP server includes these base capabilities:

• Scan Python strings, files, or directories with scan_code, scan_file, and scan_project.
• Analyze code with an optional local Ollama model.
• Detect prompt injection and classify agent-tool risk.
• Generate trust-layer code and article-specific fix suggestions.
• Explain EU AI Act articles and create full Markdown compliance reports.

With the full SDK installed, it additionally supports GDPR checks for consent, retention, erasure, transfers, and processing agreements; bias analysis covering disparate impact, protected attributes, training-data indicators, and fairness metrics; action validation with approval gates and risk filtering; and historical scan trends, scores, and audit-trail exports.

Limitations and notes

The server targets Python code and the frameworks listed in its documentation. The base installation does not provide the four SDK-powered tools. Ollama analysis also requires a separate Ollama installation and the air-compliance-v2 model. The README describes the trust and audit functionality as backed by HMAC-SHA256 audit chains and Ed25519-signed handoffs, but it does not define a hosted service or external authentication flow. Results should therefore be interpreted with their reported provenance and installed feature tier in mind.