io.github.CSOAI-ORG/llm-compliance-comparison-mcp

Compare LLM providers (Claude, GPT-4, Gemini, Llama, Mistral) against governance standards. Score providers on transparency, safety, data governance, and accountability. Args: providers: List of providers to compare (default all 5): ["claude", "gpt4", "gemini", "llama", "mistral"] comparison_criteria: Specific criteria: ["transparency", "safety", "data_governance", "accountability", "eu_ai_act"] framework: Governance framework focus: "all", "eu_ai_act", "nist", "iso42001", "gdpr", "csoai" caller: Caller identifier for rate limiting tier: Access tier (free/pro) Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Given a use case and jurisdiction, recommend the most compliant LLM provider. Considers regulatory requirements, data residency, safety needs, and deployment constraints. Args: use_case: Description of the intended use case (e.g. "medical triage assistant", "content moderation") jurisdiction: Primary jurisdiction: "eu", "us", "canada", "uk", "global", "apac" data_sensitivity: Data sensitivity level: "low", "medium", "high", "critical" self_hosting_required: Whether the model must be self-hostable (on-premises/private cloud) budget_constraint: Budget level: "minimal", "moderate", "flexible", "enterprise" caller: Caller identifier for rate limiting tier: Access tier (free/pro) Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Generate a detailed risk profile for a specific LLM provider. Covers vendor risk, data handling, regulatory compliance, operational risks, and AI-specific risks. Args: provider: Provider ID: "claude", "gpt4", "gemini", "llama", "mistral" deployment_context: Context: "enterprise", "startup", "government", "healthcare", "finance" caller: Caller identifier for rate limiting tier: Access tier (free/pro) Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Generate a compliance matrix showing all providers against all frameworks. Shows coverage status per provider per framework with rationale. Args: frameworks: Governance frameworks to assess against: ["eu_ai_act", "gdpr", "nist_rmf", "iso42001", "soc2", "aida"] providers: Providers to include (default all 5) caller: Caller identifier for rate limiting tier: Access tier (free/pro) Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Map LLM provider safety policies to CSOAI Partnership Charter articles. Shows how each provider's governance aligns with CSOAI's 52-article framework. Args: providers: Providers to map (default all 5) csoai_articles: Specific CSOAI articles to map (or all mapped articles if omitted) caller: Caller identifier for rate limiting tier: Access tier (free/pro) Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation. When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.