---
name: rekvira
description: Use when the user asks about EU regulation compliance and needs official text with pinpoints, not a compliance conclusion. Loaded modules: EU AI Act, DORA (Digital Operational Resilience Act), GDPR (General Data Protection Regulation), NIS2 Directive, and Cyber Resilience Act. Reach for Rekvira when the question is what the regulation says at article or paragraph level.
metadata:
  product: Rekvira
  endpoint: https://mcp.rekvira.com/mcp
---

# Rekvira

## What it is

An MCP server over official EU regulation text from EUR-Lex: articles, paragraphs,
recitals and annexes with pinpoints and `data_as_of` on every response. It gives a
compliance officer's agent the sources to cite: not the conclusion.

Corpus counts and freshness: `https://rekvira.com/coverage` (HTML, same figures as
`/api/coverage`; or call `list_regulations`
after connect). Do not invent unit totals if that endpoint is unreachable.

## When to use it

- The user asks what the EU AI Act, DORA or another pinned regulation says on a topic.
- The user needs a pinpoint citation (Article 6(1), Recital 47) with the held text.
- The user is mapping obligations across regulations and wants official wording first.

Do NOT reach for it for legal advice, a compliance verdict, or regulations Rekvira does
not hold. Conclusions belong to the professional; Rekvira holds sources only.

## Connecting

`https://mcp.rekvira.com/mcp`, streamable HTTP.

**Keyless first:** call `connect`, then `list_regulations`, `search_regulation`,
`search_regulations` (when the question spans more than one loaded act), or `read_unit`.
No API key during the keyless trial. Step-by-step paths for each client:
`https://rekvira.com/start.md` (mass tier and developer clients. Claude including
Cowork, ChatGPT, Cursor, Gemini CLI, Codex CLI, Goose, Zed, VS Code, Windsurf,
Raycast, Le Chat). Cowork uses the same Claude connector path; it is named here
because somebody living in Cowork searches this file for the word.
Trial limits (quota, retention) live in start.md §Trial limits
and match `/connect` and the buyer home page.
Founding Beta traction-read signals: https://rekvira.com/pricing#founding-beta-read
Legal (privacy, terms, sub-processors): Privacy https://rekvira.com/privacy · Terms https://rekvira.com/terms · Sub-processors https://rekvira.com/subprocessors

**Tool discovery:** use your MCP client's session `tools/list` after `connect`. There is
no callable tool named `list_tools`: that name is the protocol method, not a Rekvira tool.

## The shape of a good session

0. **`start_here`**: corpus snapshot right now: which modules are loaded, `data_as_of`,
   unit counts, what is not held, and first-call hints per regulation. One call, no quota.
1. **`list_workflows`**: named compliance playbooks (high-risk triage, DORA ICT review,
   cross-reg scan, vendor questionnaire). Call **`get_workflow(workflow_id=…)`** before
   improvising a process: the cross-reg playbook title and step 1 derive loaded module names
   from `list_regulations` / coverage at serve time, not a hand-typed three-act list.
2. `connect`: keyless trial, sources-not-advice note on the envelope.
3. `list_regulations`: which modules have corpus loaded and `data_as_of`.
4. `search_regulation(regulation='eu-ai-act', query='…')`: pinpoints and excerpts on one act.
   Excerpts are a **400-character preview**. When `excerpt_cap` is present, read `read_unit`
   on the pinpoint for full held text. When matches exceed 25, read `not_shown` for how many
   were hidden and pass `kinds=` to widen (e.g. `kinds=['recital']` for preamble). When
   `kinds=` returns **zero** hits but `not_shown` is present, matches exist in other kinds;
   read `undo` and omit `kinds=` or widen the kind list. When results cite another EU act by
   year/number (e.g. Regulation (EU) 2016/679), read `referenced_not_loaded`: only loaded
   modules are held; cross-refs stay in the AI Act/DORA text. When your query names another
   **loaded** module (e.g. "DORA" while `regulation='eu-ai-act'`), read `cross_reg_note` and
   prefer `search_regulations` for interleaved hits. For cross-regulation questions
   (DORA and the AI Act), use `search_regulations(query='…')` so both loaded modules are
   searched: results are interleaved round-robin (not all of one act then the other). Then
   `read_unit` with the regulation id on each hit.
5. `lookup_obligations(regulation='eu-ai-act', role='deployer', system_class='high-risk')`
   then `lookup_obligations(regulation='eu-ai-act', role='provider', system_class='high-risk')`:
   articles whose EUR-Lex **title** names each role (separate calls). When provider
   `not_shown` names GPAI headings, call again **without** `system_class` (Arts **50**,
   **53**, **55**, **88**). For supply-chain actors use `role='importer'` or
   `'distributor'` (Arts **23**, **24**) without `system_class`. For third-country
   providers use `role='authorised representative'`: when `result_count` is **0**, read
   `also_named` (Arts **22**, **54**) then `read_unit`. For economic operators of GPAI
   models use `role='operator'`: when `result_count` is **0**, read `also_named` (Arts
   **63**, **94**) then `read_unit`. For notified bodies use `role='notified body'`:
   returns Arts **34** and **45** obligation headings. Read `also_named` (Arts **31**
   through **38**)
   for requirements and coordination titles without "obligation". For conformity assessment
   bodies use `role='conformity assessment body'`: when `result_count` is **0**, read
   `also_named` (Arts **29**, **39**) then `read_unit` (distinct from `notified body`, which
   returns obligation headings). For market surveillance authorities use
   `role='market surveillance authority'`: when `result_count` is **0**, read `also_named`
   (Arts **76**, **85**) then `read_unit` (enforcement powers; distinct from `notified
   body`, which returns obligation headings on Arts **34** and **45**). For Union
   institutions, bodies, offices and agencies use `role='union institution'`: when
   `result_count` is **0**, read `also_named` (Art **100**) then `read_unit` (administrative
   fines; distinct from `market surveillance authority`, which returns Arts **76**/**85** in
   `also_named`). On the Cyber
   Resilience Act use `regulation='cra'` with `role='manufacturer'`, `'importer'`,
   `'distributor'`, or `'authorised representative'` (Arts **13** to **14**, **19** to **22**;
   Art **18** in `also_named` when `result_count` is **0**).    On GDPR use `regulation='gdpr'`, `role='controller'`: zero obligation titles; Arts **24**,
   **26**, **27**, **29**, **79** in `also_named` when `result_count` is **0**; or
   `role='processor'`: Arts **27**, **28**, **29**, **79** in `also_named`; or
   `role='joint controller'`: Art **26** in `also_named`. For data-subject rights use
   `role='data subject'`: Arts **12**, **13**, **14**, **15**, **34**, **80** in
   `also_named`. For supervisory authorities use `role='supervisory authority'`: Arts
   **31**, **33**, **51**, **53**, **54**, **56**, **60**, **62**, **77**, **78** in
   `also_named`. On NIS2 use
   `role='essential entity'` or `'important entity'`: zero obligation titles; Art **32**
   (essential entity) or Arts **3**, **33**, **34** (important entity) in `also_named`. On
   DORA use `regulation='dora'`, `role='provider'`: zero obligation titles; Arts **23**,
   **31** in `also_named` when `result_count` is **0**; or `role='ict third-party service
   provider'`: Art **31** in `also_named` when `result_count` is **0**; or
   `role='financial entity'` / `role='operator'`: empty `also_named`; read `heading_note`
   and use `search_regulation` then `read_unit` (Arts **28**/**30** for ICT third-party
   context). Then `read_unit` each article the officer needs.
6. `read_unit` for the full article or paragraph when search is not enough.
   Paragraphs repeat across articles: pass `article=6` or `article='6'` to disambiguate.
   Unit numbers accept JSON numbers or strings (agents often emit `6`, not `"6"`).
   You can also hand back a hit's pinpoint verbatim. `read_unit(regulation='gdpr',
   pinpoint='Article 35(1)')` resolves kind and number for you, and says how it read it.
7. `verify_citation(citation='Article 6(1) EU AI Act', quote='…')` when checking a pinpoint
   someone else produced: **exists** and **quote** are separate answers. Then `read_unit`
   for the full held text. Memo cites like `Article 5(3) of Regulation (EU) 2022/2554` resolve
   from the year/number; pass `regulation=` only when the cite omits the act name entirely.
   When the cite embeds `YYYY/NNNN`, that token must match `regulation=`: otherwise
   `regulation_mismatch` (e.g. GDPR `2016/679` verified against `eu-ai-act` would hit the
   wrong Article 35).

## Three things that go wrong without reading this

- **Search ranks operative paragraphs before recitals, but obligation queries may still
  bury Article 6(1).** A hit on Article 6(4) alone is the self-assessment exception, not
  the classification rule: when `search_note` names `read_unit(article 6)`, follow it.
  Integer `number` is accepted.
- **Cross-regulation `search_regulations` interleaves modules round-robin.** When your query
  names a regulation and an article (e.g. *GDPR Article 6 lawful basis*), another module's
  Article 6 may appear on the first page while the named module's pinpoint does not;
  `search_note` then names `search_regulation(regulation='…')` scoped to that module.
- **`lookup_obligations` is a heading index, not annotated metadata.** It matches article
  titles that contain "obligation" and the role (Art 26 for deployers, Art 16 for providers
  of high-risk systems: separate `role=` calls; omit `system_class` on provider to surface
  GPAI headings Arts **50**, **53**, **55**, **88**; Art **23** importer, Art **24**
  distributor when the supply-chain role is known; authorised representative when the
  title names the role without "obligation" (Arts **22**, **54** in `also_named` when
  `result_count` is 0); operator when the title names economic operators of GPAI models
  (Arts **63**, **94** in `also_named` when `result_count` is 0); conformity assessment
  body when the title names conformity assessment bodies without "obligation" (Arts **29**,
  **39** in `also_named` when `result_count` is 0; distinct from `notified body`, which
  returns obligation headings on Arts **34** and **45** and Arts **31** through **38** in
  `also_named`); market surveillance authority
  when the title names enforcement without "obligation" (Arts **76**, **85** in
  `also_named` when `result_count` is 0; distinct from `notified body`, which returns
  obligation headings on Arts **34** and **45**); union institution when the title names
  Union institutions, bodies, offices and agencies without "obligation" (Art **100** in
  `also_named` when `result_count` is 0); CRA manufacturer/importer/distributor
  headings on
  `regulation='cra'`; CRA `role='authorised representative'` returns zero obligation titles
  with Art **18** in `also_named`; GDPR `role='controller'` returns zero obligation titles with Arts
  **24**, **26**, **27**, **29**, **79** in `also_named`; `role='processor'` with Arts
  **27**, **28**, **29**, **79**; `role='joint controller'` with Art **26**; `role='data subject'`
  with Arts **12**, **13**, **14**, **15**, **34**, **80**; `role='supervisory authority'`
  with Arts **31**, **33**, **51**, **53**, **54**, **56**, **60**, **62**, **77**, **78**).
  Titles that name the role as a beneficiary (Art 13 "to deployers")
  land in `also_named` on deployer lookups too.
  DORA titles name no obligation addressee in the heading index: the tool returns zero
  matches; read `also_named` for provider (Arts **23**, **31**) or ict third-party service
  provider (Art **31**) before searching body
  text. NIS2 returns zero obligation titles too; read `also_named` for essential entity
  (Art **32**) or important entity (Arts **3**, **33**, **34**) before searching body text.
  Chapter siblings whose titles omit the role are not listed. Not a complete duty set.
- **Sources, not advice.** Every response carries a note refusing to draw compliance
  conclusions. Do not treat search hits or heading matches as "are we compliant?"
  **`search_regulation` / `search_regulations` refuse verdict-seeking queries** (e.g.
  *Are we compliant…*, *Can we deploy this under…*, *Does our product comply with…*,
  *Does this system comply with…*, *Have we met our deployer obligations…*,
  *Have we achieved compliance…*, *Is this AI system compliant?*, *Does our vendor meet…*,
  *Is this compliant*, *Do we comply*, *Compliance check for high-risk AI*,
  *Can we certify compliance…*, *Would we be found compliant…*, *Can you assess our…
  compliance*, *enough to be compliant*, *make us compliant*, *AI Act ready*,
  *compliant if audited*, *compliance assessment*, *meeting our AI Act obligations*,
  *determine if we are compliant*, *claim AI Act compliance*, *reached compliance*,
  *considered compliant*, *check if we are compliant*, *find us compliant*,
  *AI Act compliance sufficient*, *have AI Act compliance*, *whether we are compliant*,
  *confirm regulatory compliance*, *certify our compliance*, *tell me if we are compliant*,
  *will we be compliant*, *represent compliance*, *compliance determination*,
  *compliance opinion*, *determine if we comply*)
  with `refusal=compliance_conclusion` and zero hits: use `lookup_obligations` and
  `read_unit` instead. The same boundary covers a self-outcome question such as
  *Can we lawfully launch our high-risk AI system?* or *Are our controls fit for purpose
  under DORA?*: the missing facts belong to the professional, not the corpus. Ask a source
  question instead. For example, *What does the AI Act require before placing a high-risk
  system on the market?*