Which engine runs is fixed per tool rather than a runtime fallback, and each machine-readable result carries a provenance block naming the engine and a content hash of the active ruleset. That is what makes two reports comparable — same engine and ruleset version means byte-identical rules, and a diff between them is meaningful.
An MCP server that reads Python source for EU AI Act compliance problems and produces remediation rather than just findings — trust-layer integration code, article-specific fixes, and a full markdown report. It recognises LangChain, CrewAI, AutoGen, OpenAI, Haystack, LlamaIndex, Semantic Kernel, Google ADK, the Claude Agent SDK and generic RAG pipelines.
- scan_code, scan_file and scan_project — a code string, one file, or every .py file under a directory, checked against all six articles
- analyze_with_model — deeper analysis through a local fine-tuned model served by Ollama
- check_injection and classify_risk — prompt-injection detection across 15 patterns, and tools classified by EU AI Act risk level
- add_trust_layer and suggest_fix — generated trust-layer integration code, and article-specific recommendations for what to change
- explain_article and generate_compliance_report — a technical reading of an article, and a full markdown report over a project
- scan_gdpr and scan_bias — consent, retention, cross-border transfer and processing-agreement checks, and disparate-impact and protected-attribute analysis
- validate_action and compliance_history — pre-execution approval gates under Article 14, and past scans with their trend
Pip install air-blackbox-mcp gives the ten built-in tools with no other dependency; the client runs python3 -m air_blackbox_mcp over stdio. The last four — scan_gdpr, scan_bias, validate_action and compliance_history — always run through the air-blackbox SDK, so they need pip install air-blackbox-mcp[full] and return an explicit error without it. analyze_with_model needs Ollama with the air-compliance-v2 model pulled.
One command — pip install air-blackbox-mcp