Regulane MCP
An official Model Context Protocol server that allows coding agents to check code against 34 secure-coding rules mapped to ISO 27001 and the DPDP Act. It provides a scorecard of findings by severity, affected controls, and fixes without storing the code or requiring an account.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
https://regulane.com/api/mcpWhat you can do with it
- Check code against secure-coding rules mapped to ISO 27001 and the DPDP Act
- Generate a compliance scorecard with findings by severity and affected controls
- Identify specific fixes for security issues like secrets, injection, and weak cryptography
Source and maintenance
- Maintenance checked
Protocol and capabilities
- Server
- regulane 1.0.0
- MCP protocol
- 2025-06-18
- Tools
- 2 advertised
- Resources
- Not advertised
- Resource templates
- Not advertised
- Prompts
- 1 advertised
{
"tools": {
"listChanged": false
},
"prompts": {
"listChanged": false
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
2 advertised
get_compliance_rules — Get Regulane secure-coding rules
Returns the workspace's secure-coding rules: what to look for, how to fix it, and the ISO 27001 Annex A controls and DPDP Act sections each rule evidences. Call this before reviewing a change, then report with report_compliance_check.
{
"type": "object",
"properties": {
"areas": {
"type": "array",
"items": {
"enum": [
"secrets_and_auth",
"injection",
"cryptography",
"personal_data",
"logging",
"supply_chain",
"infrastructure",
"change_safety"
],
"type": "string"
},
"description": "Only the rules in these areas. Omit for all rules (recommended)."
}
},
"additionalProperties": false
}{
"title": "Get Regulane secure-coding rules",
"readOnlyHint": true,
"openWorldHint": false
}report_compliance_check — Get a Regulane compliance scorecard
Turns the check you ran against the rules from get_compliance_rules into a scorecard: findings by severity, the ISO 27001 controls and DPDP Act sections affected, and the fix for each. Report a clean check too. Regulane does not store it. Send no source code, secrets or personal data.
{
"type": "object",
"required": [
"repository",
"scope",
"rules_checked",
"findings"
],
"properties": {
"agent": {
"type": "string",
"description": "Which coding agent you are, such as \"Claude Code\", \"Cursor\", \"GitHub Copilot\", \"Codex\"."
},
"scope": {
"type": "string",
"description": "One line on what was examined, such as \"staged changes, 6 files\" or \"src/payments\"."
},
"branch": {
"type": "string",
"description": "Current branch, if known."
},
"commit": {
"type": "string",
"description": "Commit SHA the check ran against, if known."
},
"findings": {
"type": "array",
"items": {
"type": "object",
"required": [
"rule_id",
"file",
"summary"
],
"properties": {
"file": {
"type": "string",
"description": "Path relative to the repository root."
},
"line": {
"type": "integer",
"minimum": 1,
"description": "Line number, if there is one."
},
"rule_id": {
"type": "string",
"description": "The rule broken, such as RG-SC-004."
},
"summary": {
"type": "string",
"description": "One sentence on the problem. No code, secrets or personal data."
}
},
"additionalProperties": false
},
"maxItems": 200,
"description": "One entry per problem found. Empty when the check is clean."
},
"repository": {
"type": "string",
"description": "The git remote URL, or the project folder name when there is no remote."
},
"rules_checked": {
"type": "array",
"items": {
"type": "string"
},
"description": "Every rule id you checked, including those with no finding."
}
},
"additionalProperties": false
}{
"title": "Get a Regulane compliance scorecard",
"readOnlyHint": true,
"openWorldHint": false
}Prompts
1 advertised
compliance_review — Regulane compliance review
Check code against your Regulane secure-coding rules and record the result.
- scope
- What to check, such as "staged changes" or "src/payments". Defaults to uncommitted changes.
Resources
Not advertised
30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 2220 ms
- 95th percentile latency
- 2220 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 2220 ms · metadata changed · 2 tool(s), 1 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
claude mcp add --transport http regulane-mcp https://regulane.com/api/mcpCodex
codex mcp add regulane-mcp --url https://regulane.com/api/mcpCursor
{
"mcpServers": {
"regulane-mcp": {
"url": "https://regulane.com/api/mcp"
}
}
}Cline
{
"mcpServers": {
"regulane-mcp": {
"type": "streamableHttp",
"url": "https://regulane.com/api/mcp",
"disabled": false
}
}
}VS Code
{
"servers": {
"regulane-mcp": {
"type": "http",
"url": "https://regulane.com/api/mcp"
}
}
}Gemini CLI
gemini mcp add --transport http regulane-mcp https://regulane.com/api/mcpClaude Desktop
{
"mcpServers": {
"regulane-mcp": {
"url": "https://regulane.com/api/mcp"
}
}
}Windsurf
{
"mcpServers": {
"regulane-mcp": {
"serverUrl": "https://regulane.com/api/mcp"
}
}
}Let your agent find its tools
Find servers like Regulane MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.
Other developer tools servers
Do you run Regulane MCP?
Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.