
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@conformy/mcp-server
Advanced tools
EU AI Act & NIS2 compliance — classify AI systems, check NIS2 obligations, and generate compliance documentation
MCP server for EU regulatory compliance. Classify AI systems under the EU AI Act, check NIS2 cybersecurity obligations, and generate full compliance documentation — all from your AI assistant.
Documents created via MCP are synced with conformy.io — view, edit, and export them from either place.
| Tool | Description |
|---|---|
classify_ai_system | Classify an AI system by risk level (prohibited, high, limited, minimal) with Annex III category mapping |
check_deadline | EU AI Act enforcement timeline — days remaining until each deadline |
get_requirements | Required compliance documents by risk level and role (provider/deployer) |
list_annex_iii_categories | Reference list of all 8 Annex III high-risk categories |
| Tool | Description |
|---|---|
get_document_template | Get the full question template for a document type — use this first to see what info is needed |
create_document | Create a new compliance document with answers, optionally start AI generation |
list_documents | List all your documents — starting point for continuing work on existing docs |
get_document | Get a document with all answers and generated sections |
update_document_answers | Update specific answers on an existing document (only send what changed) |
generate_document | Start AI generation — only regenerates sections whose answers changed (smart diffing) |
get_generation_status | Poll generation progress |
generate_document_section | Generate a single section independently |
export_document | Export to PDF or DOCX, saved to ~/Downloads |
| Tool | Description |
|---|---|
classify_nis2_entity | Classify an organization as essential, important, or not in scope based on sector and size |
list_nis2_sectors | All Annex I (highly critical) and Annex II (other critical) sectors |
check_nis2_obligations | Article 21 risk measures, Article 23 incident reporting timelines, supervision details |
| Tool | Description |
|---|---|
check_credits | Check your remaining document generation credits |
Document generation uses prepaid credits. 1 credit = 1 AI-generated section.
Buy credits at conformy.io/sv/pricing (SEK) or conformy.io/en/pricing (EUR).
Add to your claude_desktop_config.json:
{
"mcpServers": {
"conformy": {
"command": "npx",
"args": ["-y", "@conformy/mcp-server"]
}
}
}
Classification and reference tools work without an API key. For document generation, add your key:
{
"mcpServers": {
"conformy": {
"command": "npx",
"args": ["-y", "@conformy/mcp-server"],
"env": {
"CONFORMY_API_KEY": "your-api-key"
}
}
}
}
Get an API key: sign up at conformy.io, buy credits, then create a key in your dashboard under API Keys.
{
"mcpServers": {
"conformy": {
"command": "npx",
"args": ["-y", "@conformy/mcp-server"],
"env": {
"CONFORMY_API_URL": "http://localhost:5202"
}
}
}
}
| Variable | Default | Description |
|---|---|---|
CONFORMY_API_URL | https://api.conformy.io | Conformy API base URL |
CONFORMY_API_KEY | — | API key for document generation and account features |
Classification:
"Classify our facial recognition system used for employee access control"
NIS2:
"Is our energy company subject to NIS2? We have 300 employees and €80M turnover"
Document generation:
"Get the Annex IV template, then create a document for our medical imaging AI"
Continue working on a document:
"List my documents and show me the latest Annex IV — I want to update section 3"
Export:
"Export my Annex IV document as PDF"
MIT
FAQs
EU AI Act & NIS2 compliance — classify AI systems, check NIS2 obligations, and draft compliance documentation
We found that @conformy/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.