# Costrinity Vitna Compliance Preflight MCP server

Source: https://glimind.com/server/mcp-registry%2Fxyz.costrinity%2Fvitna-compliance-preflight
Registry id: `mcp-registry/xyz.costrinity/vitna-compliance-preflight`
Status: live (checked 2026-10-27T04:43:25.094Z)

## Measurements (30 days)

- Uptime: 99.95%
- Checks: 4559
- Outages (90 days): 2

## Install

```json
{
  "mcpServers": {
    "costrinity-vitna-compliance-preflight-mc": {
      "type": "http",
      "url": "https://vitna.costrinity.xyz/api/mcp"
    }
  }
}
```

Claude Code:

```sh
claude mcp add --transport http costrinity-vitna-compliance-preflight-mc https://vitna.costrinity.xyz/api/mcp
```

## Tools (23)

- `aadhaar_mask`: Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless valid
- `ai_act_classify`: Before you build or ship an AI feature, check where it lands under the EU AI Act (Regulation 2024/1689). Describe the use case (with biometric / remote-identifi
- `breach_classify`: After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts (affected count, data categories, se
- `consent_check`: Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and opt
- `cpf_validate`: Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.
- `dpia_threshold_check`: Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categori
- `global_compliance_map`: Master catalogue of every privacy/security/sectoral regime VITNA has fabric for (28 entries covering 24 named statutes). Stateless lookup: records no decision a
- `gstin_validate`: Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `iban_validate`: Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `india_cross_border_status`: Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SE
- `india_regulators_directory`: Static reference directory of Indian data and sector regulators (DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA), optionally filtered by sector: a lookup o
- `india_sectoral_check`: Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PF
- `japan_cross_border_status`: Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-316
- `pan_classify`: Classify a PAN entity type from the 4th character (P=Person, C=Company, H=HUF, F=Firm, ...). Stateless validator: records no decision and leaves no dashboard ti
- `pii_test`: Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether sever
- `privacy_notice_get`: Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Called with an API key, the operator's name and contact details appear 
- `sin_validate`: Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `sub_processors_register`: Return the public sub-processor register (Supabase, Vercel, Resend, etc.). Stateless lookup: records no decision and leaves no dashboard timeline trace.
- `us_sectoral_check`: Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing
- `us_state_breach_deadline`: Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold (e.g. 'CA' gives 500 residents, CA AG, without unr
- `vitna_claim`: Ask whether this VITNA account has been claimed by a real person yet. Call this when the user asks about their VITNA account or when you are told evidence is no
- `vitna_help`: What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check ris
- `vitna_preflight`: SAFETY / OVERSIGHT CHECK before a dangerous or destructive action (shell command, file deletion, DB statement, network call). Call this to have VITNA check the 

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.