Open-source compliance auditing platform that validates any software project against GDPR (EU Regulation 2016/679) and LGPD (Brazilian Lei 13.709/2018) using 348 curated rules across consent, data rights, security, cookies, vendor management, and organizational measures.
- Web UI — Dark-themed Astro frontend with real-time SSE progress and compliance dashboards
- REST API — Start audits, stream progress, export JSON/CSV/Markdown reports
- MCP Server — Model Context Protocol server for AI agent integration
- 348 Rules — Covering GDPR, LGPD, and cross-regulation patterns with severity levels and remediation guidance
- Compliance Scoring — Letter grades A–F based on pass rate, requiring ≥80% rule completion
- 6 Audit Types — Code, consent, rights, security, documentation, and full audits
- Agent-Driven — Rules include
check_instructionfields designed for AI agents to verify against codebases - Dockerized — Multi-stage build with health checks and non-root user
- Go 1.21+
- Node.js 20+
git clone https://github.com/booltools/booltools-gdpr.git
cd booltools-gdpr
go mod tidy
cd web && npm install && cd ..make normalize # Build compliance_rules.db from 13 embedded parsers# Terminal 1 — API server (port 8790)
make dev
# Terminal 2 — MCP server (port 8789)
make dev-mcp
# Terminal 3 — Web UI (port 4321)
make web-devOpen http://localhost:4321 to start auditing.
docker compose up --build├── cmd/
│ ├── server/ → HTTP API server (Chi router)
│ ├── mcp-server/ → Standalone MCP server for AI agents
│ ├── normalize/ → Rule normalization pipeline
│ └── dbstats/ → Database statistics CLI
├── internal/
│ ├── api/ → Router, handlers, middleware
│ ├── mcp/ → MCP tools, sessions, bulk HTTP routes
│ └── normalizer/ → 13 parsers, schema, check-instruction generators
├── web/ → Astro frontend (SSR)
├── landing/ → Static landing page (GitHub Pages)
└── tests/ → Unit + integration tests
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/audit | Start a compliance audit |
| GET | /api/audit/:id/progress | SSE progress stream |
| GET | /api/report/:id | Full compliance report |
| GET | /api/report/:id/export/json | Download JSON report |
| GET | /api/report/:id/export/csv | Export CSV |
| GET | /api/report/:id/export/md | Export Markdown |
| GET | /api/rules?q=query | Search rules |
| GET | /api/rules/detail?id=rule_id | Rule details |
| GET | /api/health | Health check |
curl -X POST http://localhost:8790/api/audit \
-H "Content-Type: application/json" \
-d '{"language":"go","regulation":"both","audit_type":"full","min_severity":"high"}'| Field | Values |
|---|---|
| language | Required — go, javascript, python, java, etc. |
| regulation | gdpr, lgpd, both (default) |
| audit_type | code, consent, rights, security, documentation, full |
| min_severity | critical, high, medium, low, info |
| framework | Optional — express, django, spring, etc. |
| platform | Optional — aws, gcp, docker, etc. |
| tools | Optional array — react, postgres, redis, etc. |
| applies_to | code, config, documentation, all |
All rules are embedded in Go parsers and normalized into a unified SQLite database.
| Source | Description | Rules (approx.) |
|---|---|---|
| GDPR Core | EU Regulation 2016/679 — articles and recitals | 119 |
| LGPD Core | Brazilian Lei 13.709/2018 — articles and principles | 74 |
| Consent Patterns | Cookie banners, opt-in/opt-out, consent withdrawal | 15 |
| Data Rights | Access, rectification, erasure, portability requests | 15 |
| Privacy by Design | Data minimization, purpose limitation, default settings | 20 |
| Breach Notification | Incident response, authority notification, user alerting | 12 |
| Technical Security | Encryption, access control, logging, secure transport | 34 |
| Code Patterns | Hardcoded secrets, insecure storage, PII exposure | 24 |
| Organizational | ROPA, DPA, DPO appointment, training | 15 |
| Cookie & Tracking | Third-party trackers, analytics, fingerprinting | 10 |
| Vendor Management | Sub-processors, data transfer agreements, due diligence | 10 |
| Grade | Pass Rate |
|---|---|
| A | ≥ 95% |
| B | ≥ 85% |
| C | ≥ 70% |
| D | ≥ 50% |
| F | < 50% |
Reports require at least 80% of rules to be checked before a score is issued.
The MCP server lets AI agents programmatically audit code for compliance:
# Build and run
go build -o mcp-server ./cmd/mcp-server
./mcp-server
# Runs on http://localhost:8789/mcpAvailable tools: start_compliance_audit, get_rules, report_results, get_report, search_rules, get_rule_detail
Add to .cursor/mcp.json in your project root:
{
"mcpServers": {
"booltoolsGdpr": {
"url": "http://localhost:8789/mcp"
}
}
}Add to claude_desktop_config.json:
{
"mcpServers": {
"gdpr-checker": {
"command": "path/to/mcp-server",
"args": ["-db", "path/to/compliance_rules.db"]
}
}
}Use the HTTP endpoint directly:
URL: http://localhost:8789/mcp
Transport: Streamable HTTP (SSE)
Once connected, the agent should:
- Call
start_compliance_auditwith language, regulation, audit_type, and min_severity - Download rules from the returned
rules_urlto a local file - Read each rule's
check_instructionand verify against the codebase - POST results to the returned
results_url - Call
get_reportfor the final compliance summary
| Flag | Default | Description |
|---|---|---|
| PORT | 8790 | API server port |
| MCP_PORT | 8789 | MCP server port |
| DB_PATH | compliance_rules.db | Path to SQLite database |
| ALLOWED_ORIGINS | * | CORS allowed origins (comma-separated) |
| Flag | Default | Description |
|---|---|---|
| -db | ./compliance_rules.db | SQLite path |
| -port | 8789 | HTTP port |
| -verbose | false | Debug logging |
make build # Build backend binary
make build-mcp # Build MCP server binary
make build-all # Build everything
make normalize # Generate compliance database
make dbstats # Print rule database statistics
make test # Run all tests
make lint # Run go vet
make tidy # go mod tidy
make web-dev # Start Astro dev server
make web-build # Build Astro frontend
make clean # Remove build artifactsMIT