AIR Blackbox MCP – EU AI Act Compliance Scanner for AI Agents

TL;DR

TL;DR: AIR Blackbox is an open-source MCP server that scans Python AI agents for EU AI Act compliance, generates working code fixes, and adds HMAC-SHA256 audit trails — install via pip, configure in minutes.

Source and Accuracy Notes

• Project page: airblackbox.ai
• Source repository: github.com/airblackbox/air-blackbox-mcp
• License: Apache-2.0 (verified via GitHub API license.spdx_id)
• Latest release: v0.2.3 (verified via git ls-remote --tags)
• HN launch thread: news.ycombinator.com/item?id=44725306 (Show HN: Open-Source EU AI Act Scanner for Python AI Projects)
• Source last checked: 2026-07-28

What Is AIR Blackbox?

AIR Blackbox is an open-source compliance layer for AI agents built by airblackbox. The ecosystem has three parts:

1. air-blackbox-mcp — MCP server exposing 14 compliance tools to any MCP-compatible IDE (Claude Desktop, Cursor, Claude Code)
2. air-blackbox SDK — Full compliance engine with GDPR scanning, bias analysis, and action validation
3. air-trust — Cryptographic audit chain (HMAC-SHA256 with Ed25519 signed handoffs) backing the compliance layer

The EU AI Act takes full effect on August 2, 2026. If you ship AI agents into the EU and they touch public-facing systems, your code must comply with 6 technical articles or face fines up to €35 million or 7% of global revenue. The MCP server is the fastest way to audit an existing agent and get a compliance report.

The 14 MCP Tools

The server ships 10 tools out of the box; 4 more unlock when you install the full air-blackbox SDK.

Scanning (3 tools — no SDK required)

| Tool | What it does | |------|-------------| | scan_code | Scan a Python code string for all 6 EU AI Act articles | | scan_file | Read and scan a single Python file | | scan_project | Recursively scan all .py files in a directory |

Analysis (3 tools — no SDK required)

| Tool | What it does | |------|-------------| | analyze_with_model | Deep AI analysis via a local Ollama model fine-tuned on compliance data | | check_injection | Detect prompt injection attacks across 15 known patterns | | classify_risk | Classify individual tools by EU AI Act risk level |

Remediation (2 tools — no SDK required)

| Tool | What it does | |------|-------------| | add_trust_layer | Generate working AirTrust integration code for your agent | | suggest_fix | Get article-specific fix recommendations |

Documentation (2 tools — no SDK required)

| Tool | What it does | |------|-------------| | explain_article | Technical explanation of any of the 6 EU AI Act articles | | generate_compliance_report | Full markdown compliance report |

SDK-only (4 tools — requires pip install air-blackbox-mcp[full])

| Tool | What it does | |------|-------------| | scan_gdpr | GDPR-specific compliance scan (consent, retention, cross-border transfers) | | scan_bias | Bias and fairness analysis (disparate impact, protected attributes) | | validate_action | Pre-execution approval gates for agent actions (Article 14) | | compliance_history | Track past scans and compliance trends |

Setup

Prerequisites

• Python 3.10+
• pip
• (Optional) Ollama for deep analysis: brew install ollama

Step 1 — Install the MCP Server

Basic (10 tools):

pip install air-blackbox-mcp

Full (14 tools, requires SDK):

pip install "air-blackbox-mcp[full]"

The SDK auto-detects and upgrades the compliance engine to v1.6.3+ when present.

Step 2 — Configure Your IDE

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "air-blackbox": {
      "command": "python3",
      "args": ["-m", "air_blackbox_mcp"]
    }
  }
}

Restart Claude Desktop. The 14 tools appear automatically.

Claude Code / Cursor — add to .claude/mcp.json or .cursor/mcp.json in your project:

{
  "mcpServers": {
    "air-blackbox": {
      "command": "python3",
      "args": ["-m", "air_blackbox_mcp"]
    }
  }
}

Step 3 — Run Your First Scan

After restarting your IDE, try these natural-language prompts:

• “Scan this code for EU AI Act compliance”
• “Add a trust layer to this LangChain agent”
• “Check this text for prompt injection”
• “Generate a compliance report for ~/myproject”
• “Classify the risk level of send_email”

Deeper Analysis

Supported Frameworks

AIR Blackbox’s compliance engine understands the internals of:

• LangChain
• CrewAI
• AutoGen
• OpenAI Agents SDK
• Haystack
• LlamaIndex
• Semantic Kernel
• Google ADK
• Claude Agent SDK
• Generic RAG pipelines

The scanner detects these frameworks via import patterns and applies article-specific checks accordingly.

The AirTrust Wrapper

The most impactful remediation is the two-line AirTrust wrapper. Given a standard LangChain agent:

from langchain.agents import AgentExecutor

agent = AgentExecutor(agent=llm, tools=[search_database])

Wrap it with:

from air_blackbox import AirTrust

trust = AirTrust()
agent = trust.attach(AgentExecutor(agent=llm, tools=[search_database]))

The wrapper adds Article 9 (risk classification), Article 10 (input validation), Article 12 (HMAC-SHA256 tamper-evident logging), Article 14 (human oversight / kill switch), and Article 15 (drift detection) — no refactoring of existing code.

Optional Ollama Integration

For analysis beyond regex patterns, pull the fine-tuned compliance model:

brew install ollama
ollama pull air-compliance-v2

The analyze_with_model tool automatically routes to Ollama when available.

Practical Evaluation Checklist

• Does the scanner detect LangChain / CrewAI imports in a project?
• Does scan_project return results for all 6 EU AI Act articles?
• Does add_trust_layer generate syntactically valid Python?
• Does the check_injection tool catch common indirect injection patterns?
• Does explain_article return technically accurate summaries?
• Do SDK tools (scan_gdpr, scan_bias) require the [full] install to function?
• Is the HMAC-SHA256 audit trail verifiable after agent execution?

Security Notes

• The MCP server runs locally as a Python subprocess — no data leaves your machine unless you configure Ollama with a remote endpoint
• air-trust uses HMAC-SHA256 for tamper-evident logging; Ed25519 signs handoffs between agent steps
• API keys are never transmitted — the demo page uses OpenAI TTS in-browser only when you provide a key manually
• The scanner reads code statically and does not execute agent code

FAQ

Q: Does AIR Blackbox make my project fully EU AI Act compliant? A: No. It covers the 6 technical articles (9, 10, 11, 12, 14, 15). Full compliance also requires organizational measures, documentation, and registration — work with a legal team for complete coverage.

Q: Can I use it without Claude or Cursor? A: Yes. The MCP server is framework-agnostic. Any MCP-compatible client ( Windsurf, Goose, Roo Code, etc.) works. You can also use the underlying air-blackbox CLI directly.

Q: Does it work with non-Python AI agents? A: The MCP server is Python-based and the scanner analyzes Python code. For other languages, the CLI (pip install air-blackbox) provides a language-agnostic interface.

Q: What happens on August 2, 2026 if I am not compliant? A: Fines up to €35 million or 7% of global annual turnover for the most serious violations, under EU AI Act Article 101.

Conclusion

AIR Blackbox closes the gap between “shipping AI agents” and “EU AI Act compliant AI agents.” The MCP server makes compliance checks available inside your IDE with zero infrastructure changes — pip install, configure your mcp.json, and start scanning. The AirTrust wrapper handles the technical remediation with two lines of code.

For a site focused on AI developer tools, this is a timely post: the August 2026 enforcement deadline is real, and most indie devs have not started thinking about it.

• airblackbox.ai
• github.com/airblackbox/air-blackbox-mcp
• pip install air-blackbox-mcp