Compliance Governance Prover MCP Connector for Claude

Think like an external auditor preparing a SOC 2 report or GDPR readiness assessment — every claim must be traceable to a specific regulation, a specific control, a specific artifact. You must: (1) inventory REGULATIONS — name each applicable law with jurisdiction (EU/US/state), specific article or section number, and applicability rationale (WHY does this regulation apply to this system/data/process?). "Industry standards" and "applicable regulations" are not regulations. GDPR Art. 6(1)(a) Consent is a regulation. SOC 2 Type II CC6.1 Logical Access is a regulation, (2) map CONTROLS — each regulation must pair with a specific technical or procedural control. Not "we have security measures" — name the control, classify it (technical/procedural/administrative), describe the implementation, and define the verification method (how do you PROVE it works?), (3) document EVIDENCE — each control must have named audit artifacts: reports, logs, test results, certifications with dates, coverage periods, and assessor identity. "We can demonstrate compliance" is not evidence — "SOC 2 Type II report, Ernst & Young, coverage Jan-Dec 2023, 0 exceptions" is evidence, (4) quantify GAPS — each compliance gap must have: severity (1-5), fine exposure in currency with calculation basis (e.g., "up to €10M or 2% annual turnover per GDPR Art. 83"), remediation cost (engineering hours + external costs), timeline to remediation, and residual risk after remediation. "Minor gap" and "acceptable risk" are not quantification, (5) assign ACCOUNTABILITY — each control must have a named owner (person, not team), review cadence (monthly, quarterly), escalation path (who gets notified if the control fails), and last review date. "Shared responsibility" means nobody is accountable. "The compliance team handles it" is theater. If rejected, your compliance assessment has a governance flaw. Fix it before certifying. Structured reflection tool for audit-grade compliance governance analysis. Forces the agent to inventory applicable regulations by jurisdiction and article, map each regulation to specific technical/procedural controls with implementation details, document audit-ready evidence artifacts with dates and coverage, quantify compliance gaps with severity and financial exposure, and assign named accountability with review cadence and escalation paths. Catches Unnamed Regulations (citing "industry standards" or "applicable regulations" without specific articles — GDPR Art. 17, SOC 2 CC6.1, PCI DSS Req. 3.4 are regulations, "best practices" is not), Unmapped Controls (claiming "we have security measures" without linking each control to the regulation it satisfies), Undocumented Evidence (asserting "we can demonstrate compliance" without naming audit artifacts, dates, and coverage periods), Unquantified Gaps (describing gaps as "minor risk" without severity scoring, fine exposure in currency, and remediation cost), and Unassigned Accountability (controls owned by "the team" or "shared responsibility" — no named person, no review date, no escalation path). Call once per compliance assessment. Analytical support, not legal advice