
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
yaktool-compliance-mcp
Advanced tools
Product compliance as an MCP server: check a listing against Article 19 GPSR, validate EUDR plot geolocation before a Due Diligence Statement, apply FDA nutrition rounding, check an EU nutrition declaration against Regulation 1169/2011 and get the toleran
Product compliance as an MCP server — the compliance-domain suite of yaktool.com.
Seven regulatory checks that reject listings and filings for reasons a text search will not find: a missing EU responsible person, an unclosed polygon, a rounding increment applied the ordinary way, a kilocalorie figure obtained by dividing kilojoules by 4.184, a threshold crossed by 0.0001 %, a certificate written to a version of the rule that was replaced, a declaration of conformity checked against the wrong annex. 97 documented rules (18 GPSR, 24 EUDR, 8 US nutrition, 13 EU nutrition, 8 fragrance, 12 CPSC certificate, 14 EU declaration of conformity), each citing its source — and saying so plainly when a rule is our engineering reading rather than regulation text, or when it comes from Commission guidance rather than the Regulation itself. No network I/O.
check_gpsr_listing — judge a listing against the four elements of Article 19 GPSR
separately: manufacturer identity and contact, an EU responsible person where the manufacturer
is outside the Union, product identification, and warnings in each market's language.
Catches the most common failure — a correct manufacturer block with nobody inside the Union
attached — and rejects a "responsible person" whose address turns out to be in the UK.
The picture element is always reported as a manual check, never quietly passed.check_eudr_geojson — pre-check plot geolocation before a Due Diligence Statement:
unclosed polygons, swapped longitude/latitude, coordinates reused across farms, points that
collapse at six decimals, and plots over 4 hectares submitted as a single point. Every polygon
is measured from its own coordinates and compared with the declared Area. On boundaries over
2000 vertices the self-intersection check is skipped and the result says so rather than
implying a pass.check_nutrition_facts — turn laboratory values into the numbers a US Nutrition Facts
panel must print. FDA rounding is not ordinary rounding: every nutrient has its own increments
at its own levels, some values are words (less than 1 g) rather than numbers, and calories
are computed from the unrounded macronutrients — a shortcut this tool detects.round_nutrient_value — the same rounding for a single nutrient, with the increment rule
that applied, for when you need one number rather than a panel.check_eu_nutrition_declaration — check a declaration for an EU pack against Regulation
(EU) No 1169/2011: energy recalculated from the Annex XIV factors (kJ and kcal are two
factor columns, so kcal is not the kJ figure over 4.184), carbohydrate that includes polyols
and excludes fibre, the Annex XV order, and the rows the declaration may not carry at all —
trans fat, cholesterol, or a sodium figure where salt is required. Findings from the
Regulation are errors; findings from the Commission's rounding and tolerance guidance are
warnings, because that document states it has no formal legal status.eu_nutrition_tolerance — the range an official control accepts for one declared value.
It is not declared ± 20%: the printed figure is widened back to every value that rounds to
it, the band for that nutrient at that level is applied, and both ends are rounded back. A
declared 8.5 g of sugars accepts 6.5 to 11 g.check_cpsc_certificate — check a US Children's Product Certificate or General
Certificate of Conformity against 16 CFR Part 1110. The eFiling rule rewrote § 1110.11 and it
has been in force since 2026-07-08, so most templates in circulation are missing three things
at once: a unique identifier (GTIN, model, SKU, UPC…) where a description used to do, an email
address on all four parties rather than only the records custodian, and the prescribed
attestation. Validates the check digit when the identifier is a GTIN or UPC, and flags the
classic mismatch of a foreign factory named as the finished product certifier.check_eu_declaration_of_conformity — check an EU/EC Declaration of Conformity against
the annex that actually applies, not against "the eight elements" (those are the model in
Annex III of Decision 768/2008/EC). It detects the directives the declaration cites and checks
the union of their annexes, which is what stops the false positives: Annex IV of the LVD and
Annex VI of RoHS have no notified body item at all, the declaration number is optional
under RED, EMC, LVD, PPE and Machinery, a colour image is mandatory only for toys, and
citing a standard without its version is a defect under RED yet fine under the LVD.check_fragrance_allergens — convert allergen concentrations in a fragrance compound to
their concentration in the finished product and compare against the leave-on and rinse-off
thresholds. Deliberately does not ship a substance list: the authoritative one is not
publicly retrievable, and a transcribed-from-blogs list would be worse than none.claude mcp add yaktool-compliance -- npx -y yaktool-compliance-mcp
Same engine as the browser tools at yaktool.com/ecommerce/gpsr-listing-checker.
FAQs
Product compliance as an MCP server: check a listing against Article 19 GPSR, validate EUDR plot geolocation before a Due Diligence Statement, apply FDA nutrition rounding, check an EU nutrition declaration against Regulation 1169/2011 and get the toleran
The npm package yaktool-compliance-mcp receives a total of 34 weekly downloads. As such, yaktool-compliance-mcp popularity was classified as not popular.
We found that yaktool-compliance-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.