AIR Blackbox MCP – EU AI Act Compliance Scanner for AI

TL;DR

TL;DR: AIR Blackbox is an open-source MCP server that scans Python AI agents for EU AI Act compliance, generates working code fixes, and adds HMAC-SHA256 audit trails — install via pip, configure in minutes.

Source and Accuracy Notes

• Project page: airblackbox.ai
• Source repository: github.com/airblackbox/air-blackbox-mcp
• License: Apache-2.0 (verified via GitHub API license.spdx_id)
• Latest release: v0.2.3 (verified via git ls-remote --tags)
• HN launch thread: news.ycombinator.com/item?id=44725306 (Show HN: Open-Source EU AI Act Scanner for Python AI Projects)

What Is AIR Blackbox?

AIR Blackbox is an open-source compliance layer for AI agents built by airblackbox. The ecosystem has three parts:

1. air-blackbox-mcp — MCP server exposing 14 compliance tools to any MCP-compatible IDE (Claude Desktop, Cursor, Claude Code)
2. air-blackbox SDK — Full compliance engine with GDPR scanning, bias analysis, and action validation
3. air-trust — Cryptographic audit chain (HMAC-SHA256 with Ed25519 signed handoffs) backing the compliance layer

The EU AI Act takes full effect on August 2, 2026. If you ship AI agents into the EU and they touch public-facing systems, your code must comply with 6 technical articles or face fines up to €35 million or 7% of global revenue. The MCP server is the fastest way to audit an existing agent and get a compliance report.

The 14 MCP Tools

The server ships 10 tools out of the box; 4 more unlock when you install the full air-blackbox SDK.

Scanning (3 tools — no SDK required)

Tool	What it does
scan_code	Scan a Python code string for all 6 EU AI Act articles
scan_file	Read and scan a single Python file
scan_project	Recursively scan all .py files in a directory

Analysis (3 tools — no SDK required)

Tool	What it does
analyze_with_model	Deep AI analysis via a local Ollama model fine-tuned on compliance data
check_injection	Detect prompt injection attacks across 15 known patterns
classify_risk	Classify individual tools by EU AI Act risk level

Remediation (2 tools — no SDK required)

Tool	What it does
add_trust_layer	Generate working AirTrust integration code for your agent
suggest_fix	Get article-specific fix recommendations

Documentation (2 tools — no SDK required)

Tool	What it does
explain_article	Technical explanation of any of the 6 EU AI Act articles
generate_compliance_report	Full markdown compliance report

SDK-only (4 tools — requires pip install air-blackbox-mcp[full])

Tool	What it does
scan_gdpr	GDPR-specific compliance scan (consent, retention, cross-border transfers)
scan_bias	Bias and fairness analysis (disparate impact, protected attributes)
validate_action	Pre-execution approval gates for agent actions (Article 14)
compliance_history	Track past scans and compliance trends

Setup

Prerequisites

• Python 3.10+
• pip
• (Optional) Ollama for deep analysis: brew install ollama

Step 1 — Install the MCP Server

Basic (10 tools):

pip install air-blackbox-mcp
```bash

**Full (14 tools, requires SDK):**

```bash
pip install "air-blackbox-mcp[full]"
```bash

The SDK auto-detects and upgrades the compliance engine to v1.6.3+ when present.

### Step 2 — Configure Your IDE

**Claude Desktop** — edit `~/Library/Application Support/Claude/claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "air-blackbox": {
      "command": "python3",
      "args": ["-m", "air_blackbox_mcp"]
    }
  }
}
```bash

Restart Claude Desktop. The 14 tools appear automatically.

**Claude Code / Cursor** — add to `.claude/mcp.json` or `.cursor/mcp.json` in your project:

```json
{
  "mcpServers": {
    "air-blackbox": {
      "command": "python3",
      "args": ["-m", "air_blackbox_mcp"]
    }
  }
}
```bash

### Step 3 — Run Your First Scan

After restarting your IDE, try these natural-language prompts:

- "Scan this code for EU AI Act compliance"
- "Add a trust layer to this LangChain agent"
- "Check this text for prompt injection"
- "Generate a compliance report for ~/myproject"
- "Classify the risk level of `send_email`"

## Deeper Analysis

### Supported Frameworks

AIR Blackbox's compliance engine understands the internals of:

- LangChain
- CrewAI
- AutoGen
- OpenAI Agents SDK
- Haystack
- LlamaIndex
- Semantic Kernel
- Google ADK
- Claude Agent SDK
- Generic RAG pipelines

The scanner detects these frameworks via import patterns and applies article-specific checks accordingly.

### The AirTrust Wrapper

The most impactful remediation is the two-line `AirTrust` wrapper. Given a standard LangChain agent:

```python
from langchain.agents import AgentExecutor

agent = AgentExecutor(agent=llm, tools=[search_database])
```bash

Wrap it with:

```python
from air_blackbox import AirTrust

trust = AirTrust()
agent = trust.attach(AgentExecutor(agent=llm, tools=[search_database]))
```bash

The wrapper adds Article 9 (risk classification), Article 10 (input validation), Article 12 (HMAC-SHA256 tamper-evident logging), Article 14 (human oversight / kill switch), and Article 15 (drift detection) — no refactoring of existing code.

### Optional Ollama Integration

For analysis beyond regex patterns, pull the fine-tuned compliance model:

```bash
brew install ollama
ollama pull air-compliance-v2

The analyze_with_model tool automatically routes to Ollama when available.

Practical Evaluation Checklist

• Does the scanner detect LangChain / CrewAI imports in a project?
• Does scan_project return results for all 6 EU AI Act articles?
• Does add_trust_layer generate syntactically valid Python?
• Does the check_injection tool catch common indirect injection patterns?
• Does explain_article return technically accurate summaries?
• Do SDK tools (scan_gdpr, scan_bias) require the [full] install to function?
• Is the HMAC-SHA256 audit trail verifiable after agent execution?

Security Notes

• The MCP server runs locally as a Python subprocess — no data leaves your machine unless you configure Ollama with a remote endpoint
• air-trust uses HMAC-SHA256 for tamper-evident logging; Ed25519 signs handoffs between agent steps
• API keys are never transmitted — the demo page uses OpenAI TTS in-browser only when you provide a key manually
• The scanner reads code statically and does not execute agent code

FAQ

Q: Does AIR Blackbox make my project fully EU AI Act compliant? A: No. It covers the 6 technical articles (9, 10, 11, 12, 14, 15). Full compliance also requires organizational measures, documentation, and registration — work with a legal team for complete coverage.

Q: Can I use it without Claude or Cursor? A: Yes. The MCP server is framework-agnostic. Any MCP-compatible client ( Windsurf, Goose, Roo Code, etc.) works. You can also use the underlying air-blackbox CLI directly.

Q: Does it work with non-Python AI agents? A: The MCP server is Python-based and the scanner analyzes Python code. For other languages, the CLI (pip install air-blackbox) provides a language-agnostic interface.

Q: What happens on August 2, 2026 if I am not compliant? A: Fines up to €35 million or 7% of global annual turnover for the most serious violations, under EU AI Act Article 101.

Conclusion

AIR Blackbox closes the gap between “shipping AI agents” and “EU AI Act compliant AI agents.” The MCP server makes compliance checks available inside your IDE with zero infrastructure changes — pip install, configure your mcp.json, and start scanning. The AirTrust wrapper handles the technical remediation with two lines of code.

For a site focused on AI developer tools, this is a timely post: the August 2026 enforcement deadline is real, and most indie devs have not started thinking about it.

• airblackbox.ai
• github.com/airblackbox/air-blackbox-mcp
• pip install air-blackbox-mcp