Klaws — Korean compliance risk scanner

Scan code for Korean compliance risks — PIPA/개인정보보호법, Network Act, Credit Info. Not legal advice.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "klaws-korean-compliance-risk-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "klaws-korean-compliance-risk-scanner"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

klaws

한국어

Korean law compliance risk scanner for codebases. Scans source code for patterns that may indicate compliance risks under Korean law and maps findings to specific legal provisions. Runs as an MCP server (so AI coding assistants can scan on request) and as a standalone CLI.

Currently covers PIPA (Personal Information Protection Act), the Network Act (정보통신망법), the Credit Information Act (신용정보법), and the E-Commerce Act (전자상거래법).

Disclaimer: klaws identifies possible compliance risks for review. It does not constitute legal advice. Consult qualified legal counsel for definitive guidance.

Privacy: klaws analyzes code locally and transmits nothing. The only outbound network call is the optional --live law lookup to law.go.kr; without that flag it is fully offline. See Privacy & Security.

Quick Start

bash

# Scan the current directory with Docker — no install needed
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

# ...or, if you installed the binary:
klaws scan ./my-project        # scan a directory
klaws scan ./MyService.java    # scan a single file

Installation

Docker (recommended)

No toolchain required — the image is published to GitHub Container Registry and works identically on macOS, Linux, and Windows:

bash

# Scan the current directory (mount it read-only at /src)
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

# Pin a version instead of the floating latest tag
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws:0.1.6 scan /src

Prebuilt binary

Download the archive for your platform from the latest release, extract it, and move klaws onto your PATH.

go install

bash

go install github.com/rostradamus/klaws/cmd/klaws@latest

From source

Requirements: Go 1.23+

bash

git clone https://github.com/rostradamus/klaws.git
cd klaws
go build -o klaws ./cmd/klaws/

Verify the install:

bash

klaws --version

Usage

Scan

bash

# Scan a directory (default: *.java files)
klaws scan ./src

# Scan specific file types
klaws scan ./src --pattern "*.kt"

# Text output (default is JSON)
klaws scan ./src --format text

# SARIF output (for GitHub code scanning / other tools)
klaws scan ./src --format sarif > klaws.sarif

# Fail the command (exit 1) if any finding is at or above a severity
klaws scan ./src --fail-on HIGH

# Use a custom laws file
klaws scan ./src --laws ./my-laws.yaml

Example Output

Code

klaws scan report
Target:  ./testdata
Files:   4
Findings: 7

--- Finding 1 ---
  Detector:  PIPA-CST-001
  Risk:      HIGH
  Location:  testdata/MemberController.java:10
  Snippet:   @PostMapping("/register")
  Message:   Endpoint accepts possible personal data without apparent consent
             mechanism — may require review under PIPA Article 15
  Laws:      PIPA-15

--- Finding 2 ---
  Detector:  PIPA-ENC-001
  Risk:      HIGH
  Location:  testdata/MemberEntity.java:11
  Snippet:   private String residentNumber;
  Message:   Possible unencrypted personal identifier (residentNumber) — may
             require review under PIPA Article 24-2
  Laws:      PIPA-24-2, PIPA-29

--- Finding 3 ---
  Detector:  PIPA-LOG-001
  Risk:      MEDIUM
  Location:  testdata/UserService.java:11
  Snippet:   log.info("User registered: " + email);
  Message:   Possible personal data (email) in log output — may require review
             under PIPA Article 29
  Laws:      PIPA-29

Look Up Law Provisions

bash

# Look up from bundled database
klaws law PIPA-15

# Fetch live text from law.go.kr
klaws law PIPA-15 --live

List Detectors

bash

klaws detectors

config.json

[
  {
    "id": "PIPA-LOG-001",
    "name": "Personal Data Logging Risk",
    "description": "Detects log statements that may contain personal data fields",
    "related_laws": ["PIPA-29"]
  },
  {
    "id": "PIPA-ENC-001",
    "name": "Unencrypted Personal Data Risk",
    "description": "Detects personal identifier fields stored without apparent encryption",
    "related_laws": ["PIPA-24-2", "PIPA-29"]
  },
  {
    "id": "PIPA-CST-001",
    "name": "Missing Consent Check Risk",
    "description": "Detects endpoints accepting personal data without apparent consent verification",
    "related_laws": ["PIPA-15"]
  }
]

Detectors

ID	Name	What it looks for	Risk	Related Law
`PIPA-LOG-001`	Personal Data Logging	`log.*()` calls containing personal data field names (email, phone, SSN, password)	MEDIUM	PIPA Art. 29
`PIPA-ENC-001`	Unencrypted Personal Data	Sensitive identifier fields (resident number, SSN) without encryption annotations or calls	HIGH	PIPA Art. 24-2, 29
`PIPA-CST-001`	Missing Consent Check	`@PostMapping`/`@PutMapping` endpoints accepting personal data without consent verification	HIGH	PIPA Art. 15
`NIA-MKT-001`	Marketing Message Consent	Advertising/marketing message dispatch (`send`/`push`) without an apparent opt-in consent check	MEDIUM	Network Act Art. 50
`CIA-ENC-001`	Unprotected Credit Information	Credit/financial identifier fields (card number, account number, credit score) without encryption or masking	HIGH	Credit Information Act Art. 19
`ECA-RET-001`	Transaction Record Retention	Transaction record fields (order/payment IDs) stored without apparent retention or preservation handling	MEDIUM	E-Commerce Act Art. 6
`PIPA-RET-001`	Personal Data Retention	Personal data fields (email, phone, resident number) stored without apparent destruction or retention-limit handling	MEDIUM	PIPA Art. 21
`PIPA-XBR-001`	Third-Party Data Transfer	Personal data sent to a third-party or external endpoint (outbound call to an external URL/partner) without an apparent consent check	HIGH	PIPA Art. 17

Detectors use regex-based pattern matching. They support both English and Korean field names (e.g., email/이메일, residentNumber/주민번호, consent/동의).

MCP Server

klaws can run as an MCP server, making its scanning capabilities available to AI coding assistants.

bash

klaws serve

Available Tools

Tool	Description
`scan_directory`	Scan a directory for compliance risks
`scan_file`	Scan a single file
`list_detectors`	List all available detectors
`get_law_reference`	Look up a Korean law provision by ID

Configuration

All clients use the same launch command: klaws serve over stdio. Use the absolute path to the binary (run which klaws, or where klaws on Windows, to find it), or just klaws if it is on your PATH. Prefer not to install anything? Use the Docker variant below — it works in any client that supports stdio MCP servers.

Claude Code — ~/.claude/settings.json:

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Or add it in one command:

Terminal

claude mcp add klaws -- klaws serve

Claude Desktop — claude_desktop_config.json (Settings → Developer → Edit Config):

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Cursor — ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

VS Code — .vscode/mcp.json:

config.json

{
  "servers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Once connected, ask your assistant something like "scan this directory for Korean compliance risks with klaws."

Run the MCP server via Docker

No binary install needed — swap the command/args for a docker run that mounts the code you want scannable. The -i flag keeps stdin open for the stdio transport; --scan-root /src confines scans to the mounted directory:

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/absolute/path/to/your/project:/src:ro",
        "ghcr.io/rostradamus/klaws:latest",
        "serve", "--scan-root", "/src"
      ]
    }
  }
}

Point the assistant at paths under /src (the container-side mount), e.g. "scan /src for Korean compliance risks."

Remote (Streamable HTTP)

By default klaws serve uses stdio (local). To run it as a remote MCP server over HTTP, pass --http:

bash

klaws serve --http :8080
# or via the published container image:
docker run --rm -p 8080:8080 ghcr.io/rostradamus/klaws serve --http :8080

The MCP endpoint is then available at http://<host>:8080/mcp (Streamable HTTP transport). Point an HTTP-capable MCP client at that URL.

Securing a remote server

bash

klaws serve --http :8080 \
  --auth-token "$(openssl rand -hex 32)" \
  --scan-root /workspace

Read the full README →View source on GitHub →

Related MCP Servers

View all in Legal View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Klaws — Korean compliance risk scanner

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "klaws-korean-compliance-risk-scanner": { "command": "npx", "args": ["-y", "klaws — Korean compliance risk scanner"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Klaws — Korean compliance risk scanner AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/klaws-korean-compliance-risk-scanner?style=directory)](https://allmcps.com/mcp/klaws-korean-compliance-risk-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/klaws-korean-compliance-risk-scanner"><img src="https://allmcps.com/api/badge/klaws-korean-compliance-risk-scanner?style=directory" alt="Klaws — Korean compliance risk scanner on AllMCPs" /></a>

Technical Specs & Signals

CategoryLegal

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in ⚖️ Legal →Best MCP servers for Legal →Alternatives to Klaws — Korean compliance risk scanner →Install in Claude Desktop Install in Cursor Install in VS Code

Klaws — Korean compliance risk scanner

Scan code for Korean compliance risks — PIPA/개인정보보호법, Network Act, Credit Info. Not legal advice.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "klaws-korean-compliance-risk-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "klaws-korean-compliance-risk-scanner"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

klaws

한국어

Currently covers PIPA (Personal Information Protection Act), the Network Act (정보통신망법), the Credit Information Act (신용정보법), and the E-Commerce Act (전자상거래법).

Disclaimer: klaws identifies possible compliance risks for review. It does not constitute legal advice. Consult qualified legal counsel for definitive guidance.

Privacy: klaws analyzes code locally and transmits nothing. The only outbound network call is the optional --live law lookup to law.go.kr; without that flag it is fully offline. See Privacy & Security.

Quick Start

bash

# Scan the current directory with Docker — no install needed
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

# ...or, if you installed the binary:
klaws scan ./my-project        # scan a directory
klaws scan ./MyService.java    # scan a single file

Installation

Docker (recommended)

No toolchain required — the image is published to GitHub Container Registry and works identically on macOS, Linux, and Windows:

bash

# Scan the current directory (mount it read-only at /src)
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

# Pin a version instead of the floating latest tag
docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws:0.1.6 scan /src

Prebuilt binary

Download the archive for your platform from the latest release, extract it, and move klaws onto your PATH.

go install

bash

go install github.com/rostradamus/klaws/cmd/klaws@latest

From source

Requirements: Go 1.23+

bash

git clone https://github.com/rostradamus/klaws.git
cd klaws
go build -o klaws ./cmd/klaws/

Verify the install:

bash

klaws --version

Usage

Scan

bash

# Scan a directory (default: *.java files)
klaws scan ./src

# Scan specific file types
klaws scan ./src --pattern "*.kt"

# Text output (default is JSON)
klaws scan ./src --format text

# SARIF output (for GitHub code scanning / other tools)
klaws scan ./src --format sarif > klaws.sarif

# Fail the command (exit 1) if any finding is at or above a severity
klaws scan ./src --fail-on HIGH

# Use a custom laws file
klaws scan ./src --laws ./my-laws.yaml

Example Output

Code

klaws scan report
Target:  ./testdata
Files:   4
Findings: 7

--- Finding 1 ---
  Detector:  PIPA-CST-001
  Risk:      HIGH
  Location:  testdata/MemberController.java:10
  Snippet:   @PostMapping("/register")
  Message:   Endpoint accepts possible personal data without apparent consent
             mechanism — may require review under PIPA Article 15
  Laws:      PIPA-15

--- Finding 2 ---
  Detector:  PIPA-ENC-001
  Risk:      HIGH
  Location:  testdata/MemberEntity.java:11
  Snippet:   private String residentNumber;
  Message:   Possible unencrypted personal identifier (residentNumber) — may
             require review under PIPA Article 24-2
  Laws:      PIPA-24-2, PIPA-29

--- Finding 3 ---
  Detector:  PIPA-LOG-001
  Risk:      MEDIUM
  Location:  testdata/UserService.java:11
  Snippet:   log.info("User registered: " + email);
  Message:   Possible personal data (email) in log output — may require review
             under PIPA Article 29
  Laws:      PIPA-29

Look Up Law Provisions

bash

# Look up from bundled database
klaws law PIPA-15

# Fetch live text from law.go.kr
klaws law PIPA-15 --live

List Detectors

bash

klaws detectors

config.json

[
  {
    "id": "PIPA-LOG-001",
    "name": "Personal Data Logging Risk",
    "description": "Detects log statements that may contain personal data fields",
    "related_laws": ["PIPA-29"]
  },
  {
    "id": "PIPA-ENC-001",
    "name": "Unencrypted Personal Data Risk",
    "description": "Detects personal identifier fields stored without apparent encryption",
    "related_laws": ["PIPA-24-2", "PIPA-29"]
  },
  {
    "id": "PIPA-CST-001",
    "name": "Missing Consent Check Risk",
    "description": "Detects endpoints accepting personal data without apparent consent verification",
    "related_laws": ["PIPA-15"]
  }
]

Detectors

ID	Name	What it looks for	Risk	Related Law
`PIPA-LOG-001`	Personal Data Logging	`log.*()` calls containing personal data field names (email, phone, SSN, password)	MEDIUM	PIPA Art. 29
`PIPA-ENC-001`	Unencrypted Personal Data	Sensitive identifier fields (resident number, SSN) without encryption annotations or calls	HIGH	PIPA Art. 24-2, 29
`PIPA-CST-001`	Missing Consent Check	`@PostMapping`/`@PutMapping` endpoints accepting personal data without consent verification	HIGH	PIPA Art. 15
`NIA-MKT-001`	Marketing Message Consent	Advertising/marketing message dispatch (`send`/`push`) without an apparent opt-in consent check	MEDIUM	Network Act Art. 50
`CIA-ENC-001`	Unprotected Credit Information	Credit/financial identifier fields (card number, account number, credit score) without encryption or masking	HIGH	Credit Information Act Art. 19
`ECA-RET-001`	Transaction Record Retention	Transaction record fields (order/payment IDs) stored without apparent retention or preservation handling	MEDIUM	E-Commerce Act Art. 6
`PIPA-RET-001`	Personal Data Retention	Personal data fields (email, phone, resident number) stored without apparent destruction or retention-limit handling	MEDIUM	PIPA Art. 21
`PIPA-XBR-001`	Third-Party Data Transfer	Personal data sent to a third-party or external endpoint (outbound call to an external URL/partner) without an apparent consent check	HIGH	PIPA Art. 17

Detectors use regex-based pattern matching. They support both English and Korean field names (e.g., email/이메일, residentNumber/주민번호, consent/동의).

MCP Server

klaws can run as an MCP server, making its scanning capabilities available to AI coding assistants.

bash

klaws serve

Available Tools

Tool	Description
`scan_directory`	Scan a directory for compliance risks
`scan_file`	Scan a single file
`list_detectors`	List all available detectors
`get_law_reference`	Look up a Korean law provision by ID

Configuration

Claude Code — ~/.claude/settings.json:

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Or add it in one command:

Terminal

claude mcp add klaws -- klaws serve

Claude Desktop — claude_desktop_config.json (Settings → Developer → Edit Config):

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Cursor — ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

VS Code — .vscode/mcp.json:

config.json

{
  "servers": {
    "klaws": {
      "command": "klaws",
      "args": ["serve"]
    }
  }
}

Once connected, ask your assistant something like "scan this directory for Korean compliance risks with klaws."

Run the MCP server via Docker

config.json

{
  "mcpServers": {
    "klaws": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/absolute/path/to/your/project:/src:ro",
        "ghcr.io/rostradamus/klaws:latest",
        "serve", "--scan-root", "/src"
      ]
    }
  }
}

Point the assistant at paths under /src (the container-side mount), e.g. "scan /src for Korean compliance risks."

Remote (Streamable HTTP)

By default klaws serve uses stdio (local). To run it as a remote MCP server over HTTP, pass --http:

bash

klaws serve --http :8080
# or via the published container image:
docker run --rm -p 8080:8080 ghcr.io/rostradamus/klaws serve --http :8080

The MCP endpoint is then available at http://<host>:8080/mcp (Streamable HTTP transport). Point an HTTP-capable MCP client at that URL.

Securing a remote server

bash

klaws serve --http :8080 \
  --auth-token "$(openssl rand -hex 32)" \
  --scan-root /workspace

Read the full README →View source on GitHub →

Related MCP Servers

View all in Legal View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Klaws — Korean compliance risk scanner

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/klaws-korean-compliance-risk-scanner?style=directory)](https://allmcps.com/mcp/klaws-korean-compliance-risk-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/klaws-korean-compliance-risk-scanner"><img src="https://allmcps.com/api/badge/klaws-korean-compliance-risk-scanner?style=directory" alt="Klaws — Korean compliance risk scanner on AllMCPs" /></a>

Technical Specs & Signals

CategoryLegal

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in ⚖️ Legal →Best MCP servers for Legal →Alternatives to Klaws — Korean compliance risk scanner →Install in Claude Desktop Install in Cursor Install in VS Code