RuleMesh MCP

Engineered Compliance Infrastructure for engineers and AI agents.

RuleMesh delivers source-traced rules for GDPR and the EU AI Act: determine applicability, retrieve the requirements and implementation checklists that apply to a system, submit evidence signals, and track human verification. It runs as a hosted remote MCP server at https://api.rulemesh.com/mcp (Streamable HTTP, OAuth login), consumable from any MCP client.

This repo is the canonical home for the server's listing (server.json, published to the MCP Registry as com.rulemesh/compliance) and client setup docs.

Connect

You authenticate once in the browser (email/password or Google); no API key to manage. A RuleMesh account is required. The FREE tier includes GDPR. EU AI Act access and control mappings are available with a paid subscription.

OpenAI Codex

Add to ~/.codex/config.toml:

toml

[features]
rmcp_client = true            # enables the remote MCP client (use experimental_use_rmcp_client = true on older Codex)

[mcp_servers.rulemesh]
url = "https://api.rulemesh.com/mcp"
startup_timeout_sec = 30
tool_timeout_sec = 120

Then codex mcp login rulemesh (opens the browser for OAuth), and /mcp in the TUI to confirm the tools loaded.

Claude Code

Terminal

claude mcp add --transport http rulemesh https://api.rulemesh.com/mcp

Run /mcp and follow the browser login. A packaged plugin is also available at RuleMesh/rulemesh-claude-plugin.

Claude Desktop / Cursor / VS Code / other clients

Add a remote (Streamable HTTP) MCP server pointing at https://api.rulemesh.com/mcp. For example, Claude Desktop (claude_desktop_config.json) or Cursor (.cursor/mcp.json):

config.json

{
  "mcpServers": {
    "rulemesh": {
      "type": "streamable-http",
      "url": "https://api.rulemesh.com/mcp"
    }
  }
}

What you get

The server groups its 19 tools around one loop: plan, pull, implement, prove. GDPR and the EU AI Act are live today, with access depending on the account's plan.

Discovery and scoping: list_regulations, list_frameworks, lookup_definition, get_compliance_plan, scope_next_question, scope_classify, scope_retrieve_source, scope_query_applicable, scope_update_profile
Implement: pull_rules, scan_compliance
Prove: submit_signals, submit_signals_batch
Track: get_progress, get_ticket_status, get_scan_sessions, start_scan, end_scan, resume_session

Four prompts package the common workflows: implement_bundle, scan_and_report_bundle, review_bundle, and plan_compliance. One resource, regulation://{id}, returns regulation metadata.

Your coding agent reads your repository locally using RuleMesh requirements. RuleMesh does not read or receive source-code contents. Evidence submissions contain the evidence description and relevant filenames; they do not certify compliance or mark a requirement verified. Verification remains a human action.

Example prompts

"Which regulations can I use on my current RuleMesh plan?"
"Does the EU AI Act apply to this system? Ask the necessary scoping questions and cite the source provisions behind the result."
"Give me a prioritised GDPR implementation plan for this application."
"Pull the GDPR rules for my data-export feature and give me an engineering checklist."
"Review this repository against the pulled requirements. Submit only evidence signals and filenames; do not upload source code or mark anything verified."

Authentication

OAuth 2.1 with PKCE and Dynamic Client Registration. Clients register themselves and open a browser login; tokens refresh automatically.

About RuleMesh

RuleMesh is Engineered Compliance Infrastructure — the engineered rule graph that sits between regulation as written and software as built, consumable by engineers, AI agents, and auditors. It defines what each obligation requires, how to execute it with framework-specific controls, and what evidence proves it was done. GDPR and the EU AI Act are released today; more regulations are on the roadmap. → rulemesh.com

Compliance README