Bidda Sovereign Intelligence MCP Server

10,100+ source-verified regulatory compliance nodes across 39 sovereign pillars. Built to reduce hallucination by grounding every node in primary legal sources.

Actively maintained. Last reviewed 2026-08-12 - 10,108 nodes across 39 pillars, 25 MCP tools (server v1.6.0). Live counts always available via list_pillars() and GET https://bidda.com/mcp.

What is Bidda?

Bidda is a sovereign compliance intelligence registry. Every node traces to a primary legal source (avg 7 citations per node) and contains machine-executable deterministic logic, not summaries, not PDFs, not paraphrased commentary.

Pillars covered: EU AI Act · GDPR · NIST AI 600-1 · Basel III · HIPAA · DORA · FATF · SOC 2 · ISO 27001 · CCPA · PIPEDA · APRA CPS 234 · MiCA · POPIA · plus a MITRE layer across ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS and CAPEC, and 150+ others across 39 compliance domains.

MCP Endpoint

POST https://bidda.com/mcp
GET  https://bidda.com/mcp   (server info, open this in a browser to inspect)

Transport: Streamable HTTP (MCP 2025-03-26). No API key required for the discovery tier.

Tools (25)

Free discovery and intelligence (no key required)

Subscriber tools (pass your Bidda key as api_key; a free trial counts)

The discovery responses for every free tool are free. Full vault unlock (deterministic_workflow, actionable_schema, full primary_citations) costs $0.01 per node via Skyfire JWT or USDC on Base. The subscriber tools require an active Bidda subscription, which includes a free trial.

Quick Start: Claude.ai / Claude Desktop / Cursor / any MCP HTTP client

Point your MCP client at:

https://bidda.com/mcp

That is it: no install, no API key, no config file for the discovery tier. The full server-info manifest is available at GET https://bidda.com/mcp (open in a browser to inspect available tools).

Run it locally (Node or Docker)

This repo also ships a runnable local stdio MCP server (server.js) that declares the full 25-tool surface. The free discovery and intelligence tools run locally by calling the public Bidda REST API, with no API key. The subscriber and governance tools are declared with their full schemas and execute on the hosted endpoint at https://bidda.com/mcp with your Bidda key. Use it when you want the server running on your own machine or CI.

With Node (18+):

npm install
node server.js

With Docker:

docker build -t bidda-mcp .
docker run -i --rm bidda-mcp

Claude Desktop / Cursor config:

{
  "mcpServers": {
    "bidda": {
      "command": "node",
      "args": ["/absolute/path/to/bidda-mcp/server.js"]
    }
  }
}

The local server declares all 25 tools. Ten run locally with no API key: list_pillars, search_nodes, get_node, get_dependency_chain, get_crosswalk, get_mitre_mapping, get_jurisdiction_bundle, browse_topics, get_latest_changes, and check_action_compliance. compare_jurisdictions uses your Bidda key when the comparison is gated. The remaining subscriber and governance tools (attestations, the run ledger, change alerts, drift checks, and OSCAL export) require a Bidda subscription key and execute on the hosted endpoint at https://bidda.com/mcp; a free trial counts.

Example Queries

list_pillars()
search_nodes("GDPR data breach notification 72 hours")
search_nodes("Basel III capital requirements", pillar="Banking & Global Finance")
get_node("eu-ai-act-article-13-transparency")
get_dependency_chain("nist-csf-2-0-govern", max_depth=3)
get_crosswalk("gdpr-article-17-right-to-erasure")
get_jurisdiction_bundle("singapore", limit=25)
get_mitre_mapping("T1566")            # ATT&CK Enterprise (phishing)
get_mitre_mapping("AML.T0020")        # ATLAS (AI-specific)
check_action_compliance("process EU resident biometric data", jurisdiction="eu")
browse_topics("data breach notification")
compare_jurisdictions("data breach notification", api_key="YOUR_BIDDA_KEY")
create_attestation(agent="loan-bot-v2", nodes=["gdpr-article-22-automated-decisions"], api_key="YOUR_BIDDA_KEY")
open_run(agent="acme-support-bot", label="chat 8f21", api_key="YOUR_BIDDA_KEY")
record_run_entry(run_id="run_...", nodes=["gdpr-article-17-right-to-erasure"], note="User: delete my data", api_key="YOUR_BIDDA_KEY")
seal_run(run_id="run_...", api_key="YOUR_BIDDA_KEY")

Coverage (live numbers via list_pillars())

For exact live counts, call list_pillars(). The manifest at GET https://bidda.com/mcp returns the current totals dynamically.

Full coverage browser: bidda.com/intelligence

How Bidda reduces hallucination

Nodes are produced by Bidda's internal deterministic pipeline: source parsers and verification scripts do the heavy lifting, AI assists only in a small, tightly-gated drafting step, and every node passes multiple independent verification gates before publication. The whole design exists to keep drift to a minimum.