{"serverId":"mcp-registry/xyz.costrinity/vitna-compliance-preflight","tools":[{"name":"consent_check","fixed":{"name":"consent_check","description":"Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose (and optional category); returns { allowed, reason, matching_consent_id, principal_id }, a determination you must honour yourself since VITNA evaluates and records but does not enforce. Use this for personal-data processing legality; for a dangerous technical action (shell / file / DB / network) use vitna_preflight instead.","inputSchema":{"type":"object","required":["purpose"],"properties":{"purpose":{"type":"string","description":"Purpose code (e.g. 'operational_observability')."},"category":{"type":"string","description":"Optional permitted-category check."},"principal_id":{"type":"string","description":"UUID of the data principal (if known)."},"principal_ref":{"type":"string","description":"Operator-side identifier; will be SHA-256-hashed."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":264,"tokensAfter":264},{"name":"cpf_validate","fixed":{"name":"cpf_validate","description":"Validate a Brazilian CPF (mod-11 check digits, rejects all-same). Stateless validator: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["cpf"],"properties":{"cpf":{"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":77,"tokensAfter":77},{"name":"dpia_threshold_check","fixed":{"name":"dpia_threshold_check","description":"Before you start a new processing activity, check whether the law requires a DPIA first (GDPR Art 35 / DPDP §10 / LGPD Art 38). Give the purpose + data categories (and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags); returns dpia_required + the 9-criterion WP29 analysis + jurisdiction guidance, so you know whether to pause and assess before proceeding.","inputSchema":{"type":"object","required":["processing_purpose","data_categories"],"properties":{"scale":{"enum":["small","medium","large","mass"],"type":"string"},"cross_border":{"type":"boolean"},"jurisdiction":{"type":"string"},"data_categories":{"type":"array","items":{"type":"string"}},"automated_decision":{"type":"boolean"},"processing_purpose":{"type":"string"},"vulnerable_subjects":{"type":"boolean"},"systematic_monitoring":{"type":"boolean"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":252,"tokensAfter":252},{"name":"gstin_validate","fixed":{"name":"gstin_validate","description":"Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["gstin"],"properties":{"gstin":{"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":81,"tokensAfter":81},{"name":"iban_validate","fixed":{"name":"iban_validate","description":"Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["iban"],"properties":{"iban":{"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":81,"tokensAfter":81},{"name":"india_cross_border_status","fixed":{"name":"india_cross_border_status","description":"Before you transfer personal data out of India, check the destination country's DPDP §16 status (permitted / restricted / sectoral_restricted) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code (e.g. US). Stateless lookup: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["country"],"properties":{"country":{"type":"string","description":"ISO-3166 alpha-2 (e.g. US)."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":140,"tokensAfter":140},{"name":"india_sectoral_check","fixed":{"name":"india_sectoral_check","description":"Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity (RBI / SEBI / IRDAI / TRAI / DoT / PFRDA) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a plain directory of every Indian regulator regardless of your activity, use india_regulators_directory.","inputSchema":{"type":"object","required":["processing_purpose","data_categories"],"properties":{"sector_hint":{"type":"string"},"data_categories":{"type":"array","items":{"type":"string"}},"counterparty_types":{"type":"array","items":{"type":"string"}},"processing_purpose":{"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":207,"tokensAfter":207},{"name":"japan_cross_border_status","fixed":{"name":"japan_cross_border_status","description":"Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status (adequacy / standard basis / high scrutiny). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["country"],"properties":{"country":{"type":"string","description":"ISO-3166 alpha-2."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":124,"tokensAfter":124},{"name":"privacy_notice_get","fixed":{"name":"privacy_notice_get","description":"Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Called with an API key, the operator's name and contact details appear as placeholders; the signed-in owner gets the real values. Stateless generator: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","properties":{"format":{"enum":["md","json"],"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":123,"tokensAfter":123},{"name":"sin_validate","fixed":{"name":"sin_validate","description":"Validate a Canadian SIN (Luhn checksum); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.","inputSchema":{"type":"object","required":["sin"],"properties":{"sin":{"type":"string"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":80,"tokensAfter":80},{"name":"us_sectoral_check","fixed":{"name":"us_sectoral_check","description":"Before you process personal data under US law, find out which US federal sectoral regimes bind you (HIPAA, GLBA, COPPA, FERPA, FCRA, SOX) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india_sectoral_check.","inputSchema":{"type":"object","required":["processing_purpose","data_categories"],"properties":{"ai_decisions":{"type":"boolean"},"data_categories":{"type":"array","items":{"type":"string"}},"counterparty_types":{"type":"array","items":{"type":"string"}},"processing_purpose":{"type":"string"},"has_revenue_threshold":{"type":"boolean"}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":185,"tokensAfter":185}],"toolsChanged":11,"tokensSaved":0,"todo":[{"tool":"aadhaar_mask","params":["aadhaar"]},{"tool":"ai_act_classify","params":["sectors","use_case","biometric","social_scoring","data_categories","general_purpose_ai","automated_decisions","remote_identification"]},{"tool":"breach_classify","params":["sensitivity","jurisdiction","affected_count","recovery_state","data_categories","processing_purpose"]},{"tool":"cpf_validate","params":["cpf"]},{"tool":"dpia_threshold_check","params":["scale","cross_border","jurisdiction","data_categories","automated_decision","processing_purpose","vulnerable_subjects","systematic_monitoring"]},{"tool":"gstin_validate","params":["gstin"]},{"tool":"iban_validate","params":["iban"]},{"tool":"india_regulators_directory","params":["sector"]},{"tool":"india_sectoral_check","params":["sector_hint","data_categories","counterparty_types","processing_purpose"]},{"tool":"pan_classify","params":["pan"]},{"tool":"pii_test","params":["jurisdiction"]},{"tool":"privacy_notice_get","params":["format"]},{"tool":"sin_validate","params":["sin"]},{"tool":"us_sectoral_check","params":["ai_decisions","data_categories","counterparty_types","processing_purpose","has_revenue_threshold"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}