Norma Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Norma Mcp Server (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Il corpus di compliance EU di Kynosure, esposto come server MCP gratuito. EU compliance corpus across 8 frameworks (NIS2, DORA, ISO 27001, ISO 42001, EU AI Act, ISO 22301, ISO 27701, CRA), exposed as a free hosted Model Context Protocol server by Kynosure.
Disclaimer. Questo software produce bozze di policy + analisi di gap a partire da fonti regolatorie pubbliche e dalla ricerca metodologica Kynosure. Non costituisce consulenza legale. Ogni output va revisionato da un professionista legale/compliance qualificato prima di adozione in produzione.
>
Disclaimer. This software drafts policies and gap analyses from public regulatory sources and Kynosure methodology research. It is not legal advice and not a substitute for qualified counsel. Review every output with a qualified legal/compliance professional before adoption in production.
The fastest path is the Claude Code one-liner. From any terminal:
claude mcp add --transport http norma https://norma-mcp.kynosure.ai/mcpThat's it. Open a Claude Code session in any working directory, run /mcp, and you should see four tools: search_controls, map_controls, generate_policy, assess_gap.
Anonymous tier is 10 calls/hour per IP — no signup, no API key, no env vars.
Add to your project's .cursor/mcp.json:
{
"mcpServers": {
"norma": {
"url": "https://norma-mcp.kynosure.ai/mcp"
}
}
}Claude Desktop's claude_desktop_config.json does not yet officially accept a top-level url field. Two paths:
https://norma-mcp.kynosure.ai/mcp.mcp-remote:{
"mcpServers": {
"norma": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://norma-mcp.kynosure.ai/mcp"]
}
}
}Four tools, each with Zod-validated inputs and a not-legal-advice disclaimer on the response:
cross_references adjacency.{{COMPANY_NAME}}, {{SECTOR}}, {{SIZE}}, {{JURISDICTION}} and prepends a not-legal-advice header).These trigger the tools automatically from a Claude Code session with NORMA installed:
"Using NORMA, what controls does NIS2 require for access management?"
Invokes search_controls with framework: 'nis2' + keyword: 'access'. Returns control slugs, titles, source-refs, excerpts around the match.
"Using NORMA, I'm ISO 27001 certified and operate in a critical sector (energy, medium-sized). What are my NIS2 gaps?"
Invokes assess_gap with the company profile booleans. Returns counts of covered/partial/gap controls + a pointer to Pyxis for severity-ranked scoring.
"Using NORMA, generate an information security policy for Acme SRL, a small Italian SaaS company."
Invokes generate_policy with the relevant template slug + your company context. Returns a parametrized markdown draft with a prominent disclaimer header and footer.
NORMA reaches you through two equally first-class distribution surfaces. Pick the door that matches your platform and trust posture:
| MCP Server (this repo) | [Claude Skill](https://github.com/kynosure-ai/norma-claude-skill) | |
|---|---|---|
| Delivery | Live HTTPS service | Bundled local plugin |
| Corpus freshness | Always-fresh (server reads at runtime) | Pinned at install time |
| Network required | Yes | No (offline after install) |
| Client compatibility | Any MCP client (Claude Code, Cursor, Claude Desktop, custom) | Claude Code only |
| Observable usage | Yes (counters at /about) | No |
| Privacy posture | Server-side counters only, source-auditable | Fully local |
Neither is hierarchical. Same corpus, different delivery shape. The Skill is the right choice when you want a snapshot you control offline; the MCP Server is the right choice when you want the freshest corpus and observability.
This server logs counters only — never inputs, never request bodies, never IPs beyond the rate-limit bucket. The privacy posture is verifiable in source, not just claimed:
src/log.ts for the actual logger — that's the audit trail. The function whitelists scalar fields and physically drops Error objects, request bodies, and IPs before they reach stdout. Anyone can git clone and verify the privacy promise for themselves.kynosure-ai GCP project via a runtime service account with bucket-scoped read-only IAM. The service code is fully public; the corpus stays in a private bucket.What are the rate limits? Anonymous tier: 10 calls/hour per IP, enforced at the Cloudflare edge + a defense-in-depth in-app limiter. When you hit the limit, the 429 response points at the signup flow.
Do I need an API key? Not for v1.0.0 — the anonymous tier is the front door. An API-key tier (100 calls/hour, email-captured signup) is planned for v1.1 once we see anonymous-tier traction.
Which corpus version does this serve? The immutable norma-corpus-v1.0.0 tag from the upstream Kynosure repository. See PROVENANCE.md for the byte-identical mirror manifest (sha256 verified).
Which frameworks are covered? Eight: NIS2, DORA, ISO 27001, ISO 42001, EU AI Act, ISO 22301, ISO 27701, CRA. The strategic subset distributed publicly is 32 templates focused on the EU AI Act + ISO 42001 wedge — see PUBLIC-SUBSET.md in the upstream Kynosure repo for the full inventory.
Can I use this offline? This MCP server is hosted, so no — use the [NORMA Claude Skill](https://github.com/kynosure-ai/norma-claude-skill) for an offline bundled experience.
Is this a replacement for Pyxis? No. NORMA distributes; Pyxis assesses. This MCP server returns indicative search results and gap counts; the full severity-ranked cross-framework gap register with FCI/WMI/ECI scoring + sector-profiled controls + methodology-backed PDF lives at <https://kynosure.ai/en/pyxis>.
MIT, with a not-legal-advice clause appended. See LICENSE for the full text.
The NORMA corpus origin, license posture, and editorial provenance are attested in PROVENANCE.md, mirrored byte-identically from the norma-corpus-v1.0.0 tag in the upstream Kynosure repository. The byte-identical invariant is the audit trail.
This MCP server is built and maintained by Kynosure, a European compliance platform. The server exposes 4 tools — search_controls, map_controls, generate_policy, assess_gap — that route compliance questions through a curated subset of the Kynosure corpus covering NIS2, DORA, ISO 27001, ISO 22301, ISO 42001, ISO 27701, CRA, and the EU AI Act. The corpus itself is served at runtime from a private Cloud Storage bucket ("open code, private data" pattern) so the strategic-subset boundary stays enforced at the data layer, not just the code layer.
For the full multi-framework assessment, sector-profiled scoring, and methodology-backed PDF reports, see kynosure.ai.
Catalogue + side-by-side decision matrix:
— Kynosure
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.