
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
eu-reg-mcp
Advanced tools
MCP server giving AI agents cited, review-gated grounding in EU regulation: ESMA MiCAR register search, register change tracking, white paper linting, EU AI Act classification.
Let your AI assistant answer MiCAR and EU AI Act questions with citations instead of guesses — every finding flagged for human legal review.
Scope today: the ESMA interim MiCAR register (search, summary, change tracking), MiCAR white paper linting, and EU AI Act risk-tier classification. Other EU regulation is not covered.
Screenshot/GIF placeholder — to be added
It does not replace legal review: its outputs are register facts or candidate flags for a human to assess (see Guardrails).
There is no hosted playground. eu-reg-mcp is a Model Context Protocol (MCP) server, so you try it by adding it to your own MCP client — the Quick start has the configuration for Claude Code and Claude Desktop. Then ask your assistant:
<entity> on the MiCAR register, and what format is its white paper?"The first two work without extras; the third needs the classify extra.
eu-reg-mcp is on PyPI and requires Python 3.13 or newer. With uv installed, uvx fetches and runs it.
Claude Code
claude mcp add eu-reg -- uvx eu-reg-mcp
The register tools need no API key. For all five tools, add the lint and classify extras instead:
claude mcp add eu-reg -- uvx --from 'eu-reg-mcp[lint,classify]' eu-reg-mcp
claude_desktop_config.json){
"mcpServers": {
"eu-reg": {
"command": "uvx",
"args": ["eu-reg-mcp"]
}
}
}
For the extras, use "args": ["--from", "eu-reg-mcp[lint,classify]", "eu-reg-mcp"].
Without uv, run pip install 'eu-reg-mcp[lint,classify]' in a Python 3.13+ virtual environment and register its eu-reg-mcp by full path, e.g. claude mcp add eu-reg -- /path/to/.venv/bin/eu-reg-mcp; the environment need not be active. Install options and network use: docs/tools.md.
Synthetic data. Produced on 2026-10-14 by running this repo's register code (
register.search_entries/register.recent_changes) against the synthetic test fixtures intests/fixtures/, not the live register. The entity and its LEI are test data. Output shape is what a live call returns; values are not.
search_micar_register(query="skygate"):
{
"snapshot_date": "2026-07-07",
"total_matches": 1,
"results": [
{
"register": "other-wp",
"entity_name": "SKYGATE Network GmbH",
"lei": "984500BBFE52FE449926",
"member_state": "AT",
"authority": "FMA",
"whitepaper_url": "WWW.SKYGATETOKEN.AT",
"format_class": "unspecified",
"register_last_update": "30/12/2024"
}
],
"truncated": false,
"notice": "Facts from the public ESMA interim MiCAR register (Art. 109 MiCAR) as mirrored by the MiCAR Register Observatory. No legal assessment of any entity; not legal advice."
}
micar_register_changes(change_type="removed") returns the same kind of cited record (snapshot date, register, entity) and notes that "the register itself does not state why" an entry was removed. With the extras installed, the lint and classify tools cite the provision behind each finding, for example Anhang I Teil A MiCAR (MiCAR Annex I, Part A), Art. 5(1)(f) AIA, Annex III(4)(a) AIA, and Art. 51 AIA for a general-purpose AI model with systemic risk. Sample output from synthetic inputs: docs/tools.md.
An MCP server that gives AI agents cited, review-gated grounding in EU regulation.
Five tools:
| Tool | What it does | Needs |
|---|---|---|
search_micar_register | Look up an entity by name or LEI in the ESMA interim MiCAR register | — |
micar_register_summary | Register totals and white paper format coverage | — |
micar_register_changes | New filings, changed entries, removals | — |
lint_micar_whitepaper | Deterministic Annex I–III lint of a draft white paper | lint extra |
classify_eu_ai_act_system | AI Act risk tier with pinpoint citations | classify extra |
Parameters, data sources, caching and network requirements: docs/tools.md.
An ungrounded model can invent register entries or provisions. Here, register answers come from a dated snapshot of the public register, and lint/classification output comes from deterministic rules with citations. Review-gated means the output is a candidate flag pending human legal review — never a legal assessment or legal advice. Details: docs/guardrails.md.
By sebastianfoerste:
Register results are public-register facts with extraction artifacts possible; lint and classification outputs are candidate flags pending human legal review. Nothing here is legal advice. MIT licensed.
FAQs
MCP server giving AI agents cited, review-gated grounding in EU regulation: ESMA MiCAR register search, register change tracking, white paper linting, EU AI Act classification.
We found that eu-reg-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.