MCP server · GDPR and AI Act
MCP server for the GDPR and the EU AI Act
One address for every AI assistant or agent that calls a remote MCP server: nine read only tools on the AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) and the GDPR. No key, no account and no login.
The address of the server:
https://www.praxikon.com/api/mcpFree, no account and no login.
Made by Zahed Ashkara, AI and privacy legal adviser
How it works
From address to DPIA intake
- 01
Add the server
Paste the address into your client, or use the command or the install button below. No key and no account.
- 02
List the tools
tools/list returns nine typed tools, each with a description that says when to use it and a JSON Schema for its input and output.
- 03
Check a case
check_case accepts fixed answer codes only, no free text. An unknown field or a value outside the choices is refused before anything is computed.
- 04
Hand over the DPIA intake
export_dpia_intake returns a download_url: the case check on the site with the answers after the # sign. The browser does not send that part to the server; it builds the Word file there itself.
Technical
The server at a glance
- Address
https://www.praxikon.com/api/mcp- Transport
- Streamable HTTP, stateless. One JSON-RPC message per POST; GET gets 405.
- Authentication
- None: no key, no account and no OAuth.
- Tools
- Nine, all read only (readOnlyHint).
- Fixed workflows
- Four prompts: dpia-scan, fria-voorbereiding, leverancierscheck-ai and ai-act-classificatie.
- Registry
- com.praxikon/praxikon, in the public MCP registry.
- Output
- Compact by default, complete with detail “full”. Every substantive answer with the source, the locator and the URLs it was read from.
- Brake
- 300 messages per minute per client address. Not a quota, but a guard against a runaway client.
The nine tools
Your client picks the tool that fits. None of them writes or stores anything.
- classify_system
- Is a system likely high risk, and through which route?
- get_applicable_obligations
- Which obligations apply to your role, with status and date?
- explain_applicability
- Why does an obligation apply or not, step by step?
- check_case
- A case checked against the GDPR and the AI Act, with fixed answer choices.
- export_dpia_intake
- The same choices as a Word file: a link to the DPIA intake, and where it applies the FRIA draft too, built in your own browser.
- get_source_provenance
- Which official source does a statement come from, which version and which locator?
- get_national_enforcement
- Who supervises per member state, and which enforcement is known?
- answer_question
- A short general question about the AI Act or the GDPR, answered with the published answer and its sources.
- request_expert_review
- A link for a call with Zahed Ashkara, only at your request.
Install per client
The same address everywhere. In Claude and ChatGPT you add Praxikon through the listing; below are the clients for developers and organisations.
Claude Code
According to the provider’s documentation- Run this command in your terminal. Praxikon then shows up in the /mcp list.
claude mcp add --transport http praxikon https://www.praxikon.com/api/mcpCursor
According to the provider’s documentation- Click the button. Cursor opens and asks whether to install the connector.
VS Code
According to the provider’s documentation- Click the button. VS Code opens and asks whether to install the connector. Then use Praxikon in the agent mode of Copilot Chat.
Microsoft Copilot Studio
According to the provider’s documentation- Open your agent and go to Tools.
- Choose Add a tool, then New tool, then Model Context Protocol.
- Enter a name, a short description and the address, and choose None for authentication.
Generative orchestration must be on. Copilot Studio calls the address from the Microsoft cloud.
Mistral Le Chat
According to the provider’s documentation- In the side panel, open Intelligence and then Connectors.
- Choose Add connector and the Custom MCP Connector tab.
- Enter praxikon as the name and paste the address. Le Chat detects that no login is needed.
This needs admin rights. On a personal account you have them.
The documentation for developers, with the fixed workflows, is on the developers page. The full contract, with the schemas, what is kept and what is tested, is in docs-public/MCP.md in the Praxikon repository.
What you get
A DPIA intake, a FRIA draft and an outcome with sources
The same rules as the case check on the site, with no language model on our side: the same facts always give the same outcome.
- Art. 35(7) GDPR
- DPIA intake in the four parts, with the 17 points of the Dutch central government DPIA model. Each point is filled, partly filled or open.
- Art. 27(1) AI Act
- FRIA draft, points (a) to (f), built on the same facts. Only where a FRIA applies; otherwise the reason is given.
- outcome with source
- The outcome per law, with the article, the date an obligation applies and a link to the official text. What is unknown stays an open question.
The law
When is a DPIA required, and when a FRIA?
A DPIA is required when processing personal data is likely to result in a high risk to the rights and freedoms of people. You carry it out before the processing starts (Article 35(1) GDPR).
The GDPR names three cases in which a DPIA is required in any event: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; large scale processing of special categories of data or criminal offence data; and systematic monitoring of a publicly accessible area on a large scale (Article 35(3)).
Each supervisory authority also publishes a list of processing operations that require a DPIA (Article 35(4)). The list of the Dutch Data Protection Authority names seventeen, such as fraud prevention, credit scores, profiling, camera surveillance, employee monitoring and biometric data. The list is not exhaustive.
If your processing is not on the list, the nine criteria in the DPIA guidelines of the European data protection authorities help: processing that meets two or more of them requires a DPIA in most cases. The Praxikon case check follows that order: Article 35(3)(a) and (b), the list, then the criteria.
A FRIA (Article 27 AI Act) stands next to it. It applies only to the deployer of a high-risk AI system under Annex III, and then only to bodies governed by public law, private entities providing public services, and deployers using the system to evaluate the creditworthiness or credit score of natural persons (not to detect financial fraud) or for risk assessment and pricing of natural persons in life and health insurance. Critical infrastructure (Annex III point 2) is excluded. Where the DPIA already meets an obligation of the FRIA, you may cross-refer to those parts or include them in the FRIA (Article 27(4)).
Article 35 GDPR explainedArticle 27 AI Act explained
Sources
- GDPR, Regulation (EU) 2016/679, Article 35
- Dutch Data Protection Authority, decision on the list of processing operations requiring a DPIA (Stcrt. 2019, 64418), in Dutch
- EDPB, Guidelines on Data Protection Impact Assessment (WP248 rev.01)
- Kenniscentrum voor beleid en regelgeving (KCBR), Model DPIA Rijksdienst, version August 2026 (Dutch government DPIA model, in Dutch)
- AI Act, Regulation (EU) 2024/1689, consolidated text of 27 July 2026, Article 27
Privacy
Do not paste names or personal data
- Describe the processing in general terms. Names, email addresses and other personal data are not needed for the check, so do not paste them into your question.
- Of your question, Praxikon receives only fixed answer codes, such as “domain: recruitment” or “personal data: yes”, or for a short general question that question alone, at most 200 characters. The case check and the DPIA intake have no field for free text, names or an organisation name.
- Praxikon does not store your question, your answers or the Word file, and does not log the content. We do keep an anonymous daily count, including the function, the kind of assistant, the language and, for the case check, the type of organisation and the domain.
- What your assistant itself keeps of the conversation falls under that provider’s terms.
More in section 2.7 of the privacy statement.
Questions
Frequently asked questions
What is an MCP server?
A connection under the open Model Context Protocol that lets an AI assistant or agent call typed tools of another service. Claude calls such a connection a connector, ChatGPT a plugin, and elsewhere it is also called an integration or an app. Praxikon is such a connection for the GDPR and the AI Act.
Do I need an API key or an account?
No. No key, no account and no OAuth. Every call is a separate POST without a session, and no cookies are set.
Does the server write or keep anything?
No. All nine tools are read only. Praxikon does not store or log the content of requests and answers. There is an anonymous daily count, and as with any web request the technical server log may briefly hold the caller’s IP address (see section 2.7 of the privacy statement).
How do I check an answer?
Every substantive answer carries the source, the locator and the URLs it was read from, so you or your agent can repeat the call. There is no language model in the server: the same input gives the same answer on the same release.
Is Praxikon in the MCP registry?
Yes, under the name com.praxikon/praxikon, with the online connection as its only address. Clients and catalogues that read the registry find Praxikon there.
More
More on Praxikon in your AI assistant
- DPIA with ChatGPT
Add the plugin, answer the fixed questions and download the DPIA intake as a Word file.
- DPIA with Claude
Connect the connector and prepare the DPIA intake in Claude, with Article 35 GDPR and the source.
- All assistants
How to add Praxikon to every assistant, three example questions and what it does and does not do.
Not legal advice: a legal adviser signs
Praxikon prepares, it does not advise. The outcome is general information based on fixed rules, not a decision about your organisation, and Praxikon is not a supervisory authority. The DPIA itself remains the responsibility of the controller. If you want a DPIA or FRIA that a legal adviser reviews and signs, choose the signed assessment.