# eu.tracepass/compliance Answers EU Digital Product Passport questions: scope, required fields, registry and law changes. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.19.1 - **Author:** eu.tracepass - **License:** Unknown - **Endpoints:** streamable-http https://ai.tracepass.eu/compliance/mcp - **Source:** https://github.com/malinoto/tracepass-mcp-server - **Endpoint health:** reachable (last checked 2026-10-17T11:34:27.425Z, 1 sample) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan **Assessment scope:** Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - **Status:** probed (endpoint answered; no code examined) - **Scanned:** 2026-10-18T00:00:13.130Z - **Version scanned:** HEAD - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 22 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `scope_check` - `required_fields` — Lists the data a passport must contain for a product category, with the article requiring each field, who may see it, how often it changes, and whether it usual - `what_changed` — Reports changes in EU passport law and standards for the user's categories since a date (default: since they last asked). Use it for "what's new" or "has X been - `registry_guidance` — Explains the EU DPP Registry and the technical side: registration in the registry, identifiers, QR and data carriers, data formats (JSON, HTML, data models) and - `create_draft_passport` — Creates a **draft** passport in the user's own TracePass account from facts they stated. Use it whenever the user asks to create a passport, including "create a - `report_answer` — Use it when the user says an answer was wrong or unclear. Pass their words and the `ruleIds` of the answer. The report goes to a review queue. - `get_profile` — Shows the company facts the assistant has stored (categories, markets, role, own-brand flag, etc.) and when they were last updated. - `update_profile` — Saves or corrects company facts. Use it when the user states a lasting fact about their company (role, categories, markets, own-brand), or to save a `learnable` - `delete_profile` — Deletes every stored company fact. Use it only when the user explicitly asks to delete their profile. This is a separate tool so the assistant asks for confirma - `get_request` — Start here. Returns who is asking, for which product, and every field requested: its meaning, data type, unit, allowed options, expected format and the EU law i - `validate_answers` — Dry run. Reports which values would be stored, which keys were not requested (they are ignored), and which values do not fit the field's definition (wrong type, - `get_upload_command` — The best way to attach a supporting document if you can run shell commands: returns a curl command that uploads the file straight from disk, and prints a docume - `upload_evidence` — Upload one file sent inline as base64. Only for very small files (a few kilobytes): the whole file must be written out as base64 in the call, which is slow and - `submit_answers` - `get_review_status` — Whether the requester has reviewed the answers yet, the outcome, which fields they accepted and their note. Review has no deadline; linkExpiresAt is when this c - `tracepass_products` — Manage the TracePass product catalogue. A product is the catalogue layer — one product can have many passports (one per serialised unit). Products are not billa - `tracepass_passports` — Manage Digital Product Passports — create, read, and run lifecycle actions. - `tracepass_passport_fields` — Update field values on a Digital Product Passport. Every change is recorded in the passport's audit trail with the credential that made it (API key or connected - `tracepass_passport_parties` — Manage the economic-operator parties on a passport — manufacturer, importer, authorisedRepresentative, distributor, recycler, producerResponsibilityOrg. Each pa - `tracepass_epcis` — GS1 EPCIS 2.0 supply-chain events. `export`, `capture`, `capture_job` and `query` are on every plan, Free included. Captured events count against the plan's eve - `tracepass_templates` — Discover the regulatory field schema for each DPP category — what a COMPLIANT passport must contain, per the governing EU regulation. Read-only reference data. - `tracepass_scope` — Check what EU law says for a product type matching the facts given: whether it needs a Digital Product Passport, from when, at which level, under which act and ## Install **Verdict: review** — Installable, but 3 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"compliance\": {\n \"type\": \"http\",\n \"url\": \"https://ai.tracepass.eu/compliance/mcp\"\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs commands; runs on someone else's infrastructure. - Floor 42, ceiling 70 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/eu.tracepass%2Fcompliance - Install plan: https://forgeregistry.com/api/v1/packages/eu.tracepass%2Fcompliance/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/eu.tracepass%2Fcompliance - HTML page: https://forgeregistry.com/registry/eu.tracepass%2Fcompliance - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.