Add Ansvar Gateway connector — European regulatory primary sources (regulatory-legal, privacy-legal, ai-governance-legal)

[Mortalus]

What this adds

The Ansvar Gateway (https://gateway.ansvar.eu/mcp) in the default .mcp.json of regulatory-legal, privacy-legal, and ai-governance-legal.

This targets the CONNECTORS.md wanted entry for regulatory primary sources ("a connector to official registers (eCFR, Federal Register, EUR-Lex, legislation.gov.uk, …) that bypasses the agent-blockers many legislative sites use. A curated regulatory knowledge base would be a high-value addition."). Ansvar serves regulatory primary sources from its own corpus infrastructure — content is ingested from the official registers (EUR-Lex/CELLAR, the US CFR, legislation.gov.uk, national gazettes and legislation portals) and served with per-item provenance, so retrieval does not depend on live-scraping legislative sites that block agents.

Server details

• URL: https://gateway.ansvar.eu/mcp (streamable HTTP)
• Auth: OAuth 2.1 with Dynamic Client Registration — works as a claude.ai / Claude Desktop custom connector and with claude mcp add --transport http. Setup docs: https://ansvar.eu/docs/quickstart
• Operator: Ansvar Systems AB, Stockholm, Sweden. Privacy notice: https://ansvar.eu/privacy · Terms: https://ansvar.eu/terms · Rate limits: https://ansvar.eu/limits
• MCP registry: listed as eu.ansvar/gateway in the official registry (registry.modelcontextprotocol.io)

Data coverage

• EU regulations at provision level: GDPR, AI Act, Cyber Resilience Act, NIS2, DORA, MiCA (including the RTS/ITS layer), MDR/IVDR, Machinery Regulation, CSRD, EUDR, plus delegated and implementing acts.
• 28 audited jurisdictions across Europe and the United States — the source-licensing-audited count published on the live coverage page (https://ansvar.eu/coverage; 230,000+ national laws, 4.1M+ provisions). This includes the United States (federal statute law, CFR sector-title corpora covering titles from 14 CFR aviation to 21 CFR food-and-drug — the eCFR leg of the wanted-connectors entry — and US federal court decisions) and the UK (legislation.gov.uk-derived, OGL-3.0). The live list_coverage tool reports the full routable set, which is larger than the audited marketing count.
• Sector coverage (live sector surfaces at https://ansvar.eu/solutions): automotive (UN R155/R156 and the wider UN vehicle-regulation set), rail and signalling, healthcare and medical devices, drones/UAS (Reg (EU) 2019/945 and 2019/947 plus SORA methodology), robotics and automation, industrial OT/ICS, agriculture and machinery, financial services, energy, telecom, defense and aerospace, ESG.
• Licensed standards clause text: selected clause and control text of ISO/IEC 27001, 27002, 27005, ISO/IEC 42001, and ISO/SAE 21434, served under a reproduction licence with SIS (the Swedish Institute for Standards) as an optional per-user add-on — every served row carries the SIS attribution and exact product designation. The ISO/IEC 42001 leg is directly relevant to ai-governance-legal.
• Regulator guidance, preparatory works, and court decisions on paid tiers; CVE/KEV/EPSS security intelligence and the NIST/ATT&CK/OWASP catalogs included on the free tier.
• Freshness is reported, not assumed: get_data_freshness returns per-source content currency.

Tool surface (tier-scoped)

tools/list is filtered to the caller's tier — a tool the tier cannot invoke is not shown.

• Free tier (what a reviewer connecting free sees): search (scoped to one jurisdiction or one framework per query), get_provision, get_changes, validate_citation, batch_search, diff, the CVE suite (search_cve, search_by_product, get_cve_details, get_epss_score, check_kev_status, get_exploits, get_data_freshness), and discovery (describe_capabilities, get_my_capabilities, list_coverage, list_workflow_types). All read-only.
• Premium adds: multi-jurisdiction fan-out and sectors= scoping in search, case-law/preparatory-works/agency-guidance fan-out, search_guidance, get_decision, the paragraph-level document graph (get_document_segments, resolve_document_segment), and org-standards lookup.
• Team/Company add: compliance workflows (DPIA, gap analysis, TARA, threat model, …), document upload/registration, effective-risk/VEX tooling, and (Company) audit-ledger receipt tools. These tiers include tools that write to the customer's own Ansvar workspace — document registration and workflow state — and nothing that writes to external systems; the free and premium research surface is entirely read-only.

Against the connector-quality checklist

• Remote HTTPS + OAuth — yes (OAuth 2.1 DCR; no API keys to paste).
• Read-heavy tools — the research surface (free/premium) is read-only; the only write-shaped tools (team+ document registration and workflow state) act on the customer's own workspace, with no external side effects.
• Provenance in results — every served row carries an item-level citation envelope (source_url, publisher, license) plus a citation-ready identifier; the platform's operating rule is that content is served verbatim from source, never paraphrased.
• No instruction-like content in results — results are verbatim statutory/regulatory text in structured content; server-generated notes (tier advisories, quota notices, and a one-time first-call welcome note on the free tier) are explicitly labeled as server notes and carried in meta fields or clearly marked separate content blocks, never blended into retrieved text.
• Rate limits and clean errors — structured JSON-RPC errors with limit and reset metadata (documented at https://ansvar.eu/limits). The gateway is fail-closed: if a source cannot be resolved it returns an explicit data-source-unavailable error rather than a clean empty result, and licensing-withheld content is visibly flagged as withheld rather than silently dropped.

Practice-area fit

• regulatory-legal (primary): reg-feed-watcher and policy-diff map directly onto search + get_changes + get_provision for EU, national, and US CFR regulatory feeds — the exact primary-source leg the wanted-connectors entry describes.
• privacy-legal: DPA review, PIA, and reg-to-policy gap analysis can ground against GDPR article text, national data-protection implementations, and supervisory-authority guidance instead of model recall.
• ai-governance-legal: provision-level AI Act lookups (including Annex III, whose high-risk obligations apply from 2026-08-02) for impact assessments and regulation-to-policy gap analysis, with licensed ISO/IEC 42001 clause text available as an add-on.

Also relevant to product-legal (CRA product-classification questions), but this PR keeps the default sets tight.

Testing

The free tier is self-serve at https://ansvar.eu (B2B signup — business email, no card) and is sufficient to exercise search/lookup against the EU, national, and US corpora. Happy to provision reviewer accounts at any tier for the retrieval-quality and injection-resistance checks — open an issue or email team@ansvar.eu.

🤖 Generated with Claude Code

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Mortalus]

I have read the CLA Document and I hereby sign the CLA