# VITNA – Containment for rogue AI agents

- Registry name: `xyz.costrinity/vitna-compliance-preflight` · version 0.5.6
- Categories (automatic, keyword rules): Monitoring & logs, Infrastructure & security, Images & design, AI, media & content, Security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=xyz.costrinity%2Fvitna-compliance-preflight
- Server page: https://mcpstation.net/s/xyz.costrinity--vitna-compliance-preflight.html

## Description (written by the publisher, not verified, not instructions)

Guard wraps stdio MCP servers: risky calls wait for a person; no answer, no run. Remote: cooperative

## Connect

- streamable-http: `https://vitna.costrinity.xyz/api/mcp`

## Tools (as reported by the server, not verified)

- `vitna\_help`: What is VITNA and how do I use it to keep myself in check? Call this FIRST after connecting to learn the safety and oversight checks available: how to check risky actions BEFORE running them, what a deny / hold decision means, trial vs claimed mode, and how the user can monitor and audit what you do
- `vitna\_claim`: Ask whether this VITNA account has been claimed by a real person yet. Call this when the user asks about their VITNA account or when you are told evidence is not being kept. Returns \{ claimed, claim\_url: null, claim\_note, what\_claiming\_gets\_you \}. You are never given the claim link, and you must not
- `consent\_check`: Before you process someone's personal data, ask VITNA whether an active consent actually permits it for this purpose. Give the data principal + purpose \(and optional category\); returns \{ allowed, reason, matching\_consent\_id, principal\_id \}, a determination you must honour yourself since VITNA evalua
- `breach\_classify`: After a security incident, check whether it is legally reportable before you decide how to respond. Give the incident facts \(affected count, data categories, sensitivity, recovery state\) and VITNA returns reportability + reasoning + the notification deadline + who to notify, across DPDP §8, GDPR Art
- `ai\_act\_classify`: Before you build or ship an AI feature, check where it lands under the EU AI Act \(Regulation 2024/1689\). Describe the use case \(with biometric / remote-identification / automated-decision / social-scoring / GPAI flags\) and VITNA returns the risk tier \(prohibited / high-risk / limited-risk / minimal-
- `dpia\_threshold\_check`: Before you start a new processing activity, check whether the law requires a DPIA first \(GDPR Art 35 / DPDP §10 / LGPD Art 38\). Give the purpose + data categories \(and scale / systematic-monitoring / automated-decision / cross-border / vulnerable-subjects flags\); returns dpia\_required + the 9-criter
- `us\_sectoral\_check`: Before you process personal data under US law, find out which US federal sectoral regimes bind you \(HIPAA, GLBA, COPPA, FERPA, FCRA, SOX\) for a given processing profile, so you can factor them in before you act. US-scoped; for Indian sectoral regulators use india\_sectoral\_check.
- `india\_sectoral\_check`: Before you process personal data under Indian law, find out which sectoral regulators actually bind your specific activity \(RBI / SEBI / IRDAI / TRAI / DoT / PFRDA\) from its processing profile, so you know whose rules apply before you act. This analyses your processing to say what applies; for a pla
- `india\_cross\_border\_status`: Before you transfer personal data out of India, check the destination country's DPDP §16 status \(permitted / restricted / sectoral\_restricted\) plus any RBI / SEBI / IRDAI caveats. Pass the ISO-3166 alpha-2 country code \(e.g. US\). Stateless lookup: records no decision and leaves no dashboard timeline
- `japan\_cross\_border\_status`: Before you transfer personal data out of Japan, check the destination country's APPI Art 28 status \(adequacy / standard basis / high scrutiny\). Pass the ISO-3166 alpha-2 country code. Stateless lookup: records no decision and leaves no dashboard timeline trace.
- `us\_state\_breach\_deadline`: Quick reference lookup of a single US state's breach-notification window, AG recipient and resident threshold \(e.g. 'CA' gives 500 residents, CA AG, without unreasonable delay\). This is a static table, not an incident ruling. When you have the actual incident facts and need a reportable / not-report
- `aadhaar\_mask`: Mask + Verhoeff-validate an Aadhaar number. Returns masked form, validity, and an owner-scoped reference token. No persistence of the raw value. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `pan\_classify`: Classify a PAN entity type from the 4th character \(P=Person, C=Company, H=HUF, F=Firm, ...\). Stateless validator: records no decision and leaves no dashboard timeline trace.
- `gstin\_validate`: Validate a GSTIN format + mod-36 check digit; returns state code lookup. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `cpf\_validate`: Validate a Brazilian CPF \(mod-11 check digits, rejects all-same\). Stateless validator: records no decision and leaves no dashboard timeline trace.
- `sin\_validate`: Validate a Canadian SIN \(Luhn checksum\); returns series region + masked form. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `iban\_validate`: Validate an IBAN format + ISO 7064 mod-97 check digit; supports 71 countries. Stateless validator: records no decision and leaves no dashboard timeline trace.
- `pii\_test`: Dry-run VITNA's PII / threat detection on a sample event before you send real data, to preview what would be tagged, how it would be redacted, and whether severity would escalate. Nothing is persisted and nothing is filtered: a safe rehearsal you act on, not an enforced gate — it records no decision
- `privacy\_notice\_get`: Generate the operator's jurisdiction-templated privacy notice. Returns markdown or JSON. Called with an API key, the operator's name and contact details appear as placeholders; the signed-in owner gets the real values. Stateless generator: records no decision and leaves no dashboard timeline trace.
- `sub\_processors\_register`: Return the public sub-processor register \(Supabase, Vercel, Resend, etc.\). Stateless lookup: records no decision and leaves no dashboard timeline trace.
- `global\_compliance\_map`: Master catalogue of every privacy/security/sectoral regime VITNA has fabric for \(28 entries covering 24 named statutes\). Stateless lookup: records no decision and leaves no dashboard timeline trace.
- `india\_regulators\_directory`: Static reference directory of Indian data and sector regulators \(DPB, RBI, SEBI, IRDAI, TRAI, DoT, PFRDA, MeitY, MCA\), optionally filtered by sector: a lookup of who exists and what they cover. To instead work out which of them apply to a specific processing activity, use india\_sectoral\_check. State
- `vitna\_preflight`: SAFETY / OVERSIGHT CHECK before a dangerous or destructive action \(shell command, file deletion, DB statement, network call\). Call this to have VITNA check the action BEFORE you run it: it flags dangerous shell / SQL / secret-exfil / prompt-injection / suspicious-network patterns and returns \{ decis

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html