@weave_protocol/domere
Advanced tools
The Judge Protocol - Thread identity, intent verification, and blockchain anchoring
Enterprise Compliance, Verification, GDPR & CCPA for AI Agents
Part of the Weave Protocol security suite.
| Category | Features |
|---|---|
| Verification | Intent tracking, drift detection, execution replay, multi-agent handoff |
| Orchestration | Task scheduler, agent registry, shared state with locks |
| Compliance | SOC2, HIPAA, PCI-DSS, ISO27001, GDPR, CCPA checkpoints & reporting |
| Blockchain | Solana & Ethereum anchoring for immutable audit trails |
| GDPR | Consent management, DSAR handling, breach notification, retention enforcement |
| CCPA | Consumer requests, opt-out management, sale disclosure, annual metrics |
npm install @weave_protocol/domere
import { ComplianceManager } from '@weave_protocol/domere';
const compliance = new ComplianceManager(['soc2', 'hipaa', 'gdpr']);
// Create tamper-evident checkpoint
const checkpoint = await compliance.createCheckpoint({
action: 'data_access',
resource: 'patient_records',
actor: 'agent-medical-01',
metadata: { reason: 'treatment_review' }
});
console.log(checkpoint.hash); // SHA-256 hash for verification
Add to claude_desktop_config.json:
{
"mcpServers": {
"domere": {
"command": "npx",
"args": ["-y", "@weave_protocol/domere"]
}
}
}
Domere includes comprehensive GDPR support with 11 MCP tools.
| Tool | GDPR Article | Purpose |
|---|---|---|
domere_gdpr_record_consent | Art 6, 7 | Record consent with legal basis |
domere_gdpr_withdraw_consent | Art 7(3) | Process consent withdrawal |
domere_gdpr_check_consent | Art 6 | Verify valid consent exists |
domere_gdpr_handle_dsar | Art 15-22 | Manage all subject rights requests |
domere_gdpr_right_to_erasure | Art 17 | Execute "right to be forgotten" |
domere_gdpr_data_portability | Art 20 | Export data in portable format |
domere_gdpr_log_processing | Art 30 | Maintain processing records |
domere_gdpr_breach_notify | Art 33-34 | 72-hour breach notification workflow |
domere_gdpr_retention_check | Art 5(1)(e) | Enforce storage limitation |
domere_gdpr_automated_decision | Art 22 | Track AI decisions & human review |
domere_gdpr_report | Various | Generate compliance reports |
import { GDPRManager } from '@weave_protocol/domere';
const gdpr = new GDPRManager({
name: 'Acme Corporation',
email: 'dpo@acme.com',
address: '123 Main St, London',
dpoContact: 'Jane Smith'
});
const consent = gdpr.recordConsent({
subjectId: 'user-abc-123',
purpose: 'marketing',
legalBasis: 'consent',
granted: true,
source: 'web_form',
version: '2.1.0'
});
// Create DSAR - automatically sets 30-day deadline
const dsar = gdpr.createDSAR({
subjectId: 'user-abc-123',
type: 'access',
verificationMethod: 'email'
});
// Check for overdue requests
const overdue = gdpr.getOverdueDSARs();
Domere v1.3.4+ includes comprehensive California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) support with 18 MCP tools.
| Aspect | GDPR | CCPA |
|---|---|---|
| Deadline | 30 days | 45 days (extendable +45) |
| Terminology | Data Subject | Consumer |
| Controller | Data Controller | Business |
| Key Right | Right to Erasure | Right to Opt-Out of Sale |
| Signal | — | Global Privacy Control (GPC) |
| Tool | CCPA Section | Purpose |
|---|---|---|
ccpa_register_consumer | 1798.140 | Register consumer for tracking |
ccpa_get_consumer | 1798.140 | Lookup consumer by ID or email |
ccpa_record_opt_out | 1798.120 | Record Do Not Sell/Share opt-out |
ccpa_process_gpc | 1798.135 | Process Global Privacy Control signal |
ccpa_withdraw_opt_out | 1798.120 | Consumer withdraws opt-out |
ccpa_get_opt_outs | 1798.120 | List consumer's active opt-outs |
ccpa_check_opt_out | 1798.120 | Check if opt-out is active |
ccpa_submit_request | 1798.100-106 | Submit consumer request |
ccpa_verify_request | 1798.185 | Verify consumer identity |
ccpa_extend_request | 1798.105 | Extend deadline by 45 days |
ccpa_complete_request | 1798.100-106 | Complete with response |
ccpa_deny_request | 1798.105 | Deny with valid reason |
ccpa_get_pending_requests | — | List pending requests |
ccpa_get_overdue_requests | — | List overdue requests (alert!) |
ccpa_generate_report | 1798.185 | Generate compliance report |
ccpa_annual_metrics | 1798.185(a)(7) | Required annual disclosure |
ccpa_get_checkpoints | — | Audit trail for compliance |
ccpa_verify_chain | — | Verify checkpoint integrity |
import { CCPAManager } from '@weave_protocol/domere';
const ccpa = new CCPAManager({
id: 'biz-001',
name: 'Acme Corporation',
address: '123 Main St, San Francisco, CA',
privacyPolicyUrl: 'https://acme.com/privacy',
doNotSellUrl: 'https://acme.com/do-not-sell',
contactEmail: 'privacy@acme.com',
meetsThreshold: true
});
// Register consumer
const consumer = ccpa.registerConsumer({
email: 'user@example.com',
californiaResident: true
});
// Record opt-out (Do Not Sell My Personal Information)
const optOut = ccpa.recordOptOut({
consumerId: consumer.id,
optOutType: 'sale',
source: 'web_form'
});
// Check if consumer has opted out
const hasOptedOut = ccpa.hasActiveOptOut(consumer.id, 'sale');
// Process GPC signal - automatically opts out of sale AND sharing
const optOuts = ccpa.processGPC(consumer.id);
console.log(`Created ${optOuts.length} opt-outs via GPC`); // 2
// Submit Right to Know request
const request = ccpa.submitRequest({
consumerId: consumer.id,
type: 'know_specific',
source: 'web_form'
});
console.log(`Due: ${request.dueDate}`); // 45 days from now
// Verify identity before processing
ccpa.verifyRequest(request.id, 'email_verification');
// Need more time? Extend once by 45 days
ccpa.extendRequest(request.id, 'Complex request');
// Complete with response
ccpa.completeRequest(request.id, {
actions: [
{ type: 'disclosed', dataCategory: 'identifiers', recordCount: 5 },
{ type: 'disclosed', dataCategory: 'commercial_info', recordCount: 23 }
],
format: 'json'
});
// Required annual disclosure per CCPA Section 1798.185(a)(7)
const metrics = ccpa.generateAnnualMetrics(2025);
console.log('Right to Know:', metrics.requestsToKnow);
console.log('Right to Delete:', metrics.requestsToDelete);
console.log('Right to Opt-Out:', metrics.requestsToOptOut);
| Category | Examples |
|---|---|
identifiers | Name, SSN, driver's license, passport |
customer_records | Paper/electronic customer records |
protected_classifications | Age, race, religion, sexual orientation |
commercial_info | Products purchased, purchase history |
biometric | Fingerprints, face recognition |
internet_activity | Browsing history, search history |
geolocation | Precise physical location |
sensory_data | Audio, video, thermal data |
professional_info | Employment information |
education_info | Non-public education records |
inferences | Consumer profiles, predictions |
sensitive_personal_info | CPRA sensitive categories |
Anchor checkpoints to blockchain for immutable audit proof:
const anchor = await compliance.anchorToBlockchain(checkpoint.id, 'solana');
console.log(`Transaction: ${anchor.transactionId}`);
Blockchain Addresses:
6g7raTAHU2h331VKtfVtkS5pmuvR8vMYwjGsZF1CUj2oBeCYVJYfbUu3k2TPGmh9VoGWeJwzm2hg2NdtnvbdBNCj0xAA8b52adD3CEce6269d14C6335a79df451543820| Framework | Status | Description |
|---|---|---|
| SOC2 | ✅ Implemented | Trust Services Criteria |
| HIPAA | ✅ Implemented | Healthcare data protection |
| PCI-DSS | ✅ Implemented | Payment card security |
| ISO27001 | ✅ Implemented | Information security management |
| GDPR | ✅ Implemented | EU data protection regulation |
| CCPA/CPRA | ✅ Implemented | California consumer privacy |
domere_checkpoint Create tamper-evident checkpoint
domere_verify Verify checkpoint integrity
domere_compliance_report Generate framework report
domere_anchor_blockchain Anchor to Solana/Ethereum
domere_gdpr_record_consent Record/update consent
domere_gdpr_withdraw_consent Withdraw consent
domere_gdpr_check_consent Check consent status
domere_gdpr_handle_dsar Create/manage DSARs
domere_gdpr_right_to_erasure Execute data deletion
domere_gdpr_data_portability Export subject data
domere_gdpr_breach_notify Breach management
domere_gdpr_retention_check Retention enforcement
domere_gdpr_automated_decision Article 22 tracking
domere_gdpr_report Compliance reporting
ccpa_register_consumer Register California consumer
ccpa_get_consumer Lookup consumer
ccpa_record_opt_out Do Not Sell / Do Not Share
ccpa_process_gpc Global Privacy Control signal
ccpa_withdraw_opt_out Withdraw opt-out
ccpa_check_opt_out Check opt-out status
ccpa_submit_request Submit consumer request
ccpa_verify_request Verify identity
ccpa_extend_request Extend 45-day deadline
ccpa_complete_request Complete with response
ccpa_deny_request Deny with reason
ccpa_get_pending_requests List pending requests
ccpa_get_overdue_requests Alert: overdue requests
ccpa_generate_report Compliance reports
ccpa_annual_metrics Required annual disclosure
ccpa_get_checkpoints Audit trail
ccpa_verify_chain Verify checkpoint integrity
Skill name: compliance-auditing
Triggers: audit, checkpoint, SOC2, HIPAA, PCI-DSS, ISO27001, GDPR, CCPA, CPRA, blockchain, consent, DSAR, consumer request, opt-out, breach, retention
Apache 2.0 - See LICENSE
FAQs
The Judge Protocol - Thread identity, intent verification, and blockchain anchoring
We found that @weave_protocol/domere demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.