🛡️ CompliRules: Compliance-as-Code & Legal AI Guardrail Engine

The enterprise-grade compliance guardrail engine, deterministic AST linter, and Model Context Protocol (MCP) server that keeps AI coding assistants ("Vibe Coders", Cursor, Claude Code, Windsurf) and engineering teams strictly compliant with global privacy laws, statutory retention mandates, and judicial precedents.

🌐 Live Website & Documentation: https://halilyilmz.github.io/complirules/
⚖️ Binding Legal Terms & Disclaimer: DISCLAIMER.md

---

⚡ Quick Start

1. Initialize CompliRules in Your Project

# Automatic setup inspecting your project stack:
npx complirules init

# Target specific jurisdictions (e.g. EU, TR, US):
npx complirules init --jurisdiction EU,TR,US

# Install all global regulatory packs:
npx complirules init --all

This command automatically:

• Injects 24 production .cursor/rules/*.mdc rule definitions with strict RFC 2119 invariants (MUST, NEVER).
• Generates AGENTS.md and CLAUDE.md for Claude Code, Windsurf, and GitHub Copilot.
• Configures .cursor/mcp.json to connect the live Model Context Protocol server.

---

2. Audit Your Codebase (AST + Regex Linter)

# Runs deterministic TypeScript Compiler API AST and pattern scans across your codebase:
npx complirules check

# Scan a specific directory or file:
npx complirules check ./src

---

3. Generate Statutory RoPA & VERBİS Inventories

# Automatically derives a GDPR Article 30 (RoPA) & KVKK VERBİS inventory from your database schema:
npx complirules ropa prisma/schema.prisma

---

🏛️ Supported Statutory Frameworks & Landmark Precedents

---

🔌 Model Context Protocol (MCP) Server

CompliRules equips AI coding models with direct, real-time compliance reasoning tools via the Model Context Protocol (MCP). When you run complirules init, your .cursor/mcp.json is configured automatically:

{
  "mcpServers": {
    "complirules": {
      "command": "npx",
      "args": ["@complirules/mcp-server"]
    }
  }
}

16 Registered Production MCP Tools:

1. verify_schema_compliance: Audits Prisma, Drizzle, or SQL schemas against statutory retention and cascade delete rules.
2. audit_code_pii: Inspects source code in real time for raw credential, national ID, or PII/PHI telemetry leakage.
3. check_ui_dark_patterns: Flags pre-ticked checkboxes, bundled consents, and missing accessible names.
4. generate_ropa_inventory: Generates comprehensive 10-column RoPA and VERBİS tables from database schemas.
5. lookup_legal_citation: Queries official statutory articles, judicial precedents, and regulatory fines.
6. lookup_active_partner: Queries community-vetted penetration testing (pentest) and compliance partners with exclusive community discounts.
7. verify_transfer_adequacy: Evaluates cross-border data transfer legality under GDPR Chapter V (Schrems II) and Turkish KVKK Art. 9.
8. generate_dpia: Synthesizes structured Data Protection Impact Assessments (DPIA) per GDPR Art. 35 and WP248 criteria.
9. check_dependency_privacy: Audits npm dependencies for hidden ad-tech, session recording, and telemetry liabilities.
10. check_hipaa_safeharbor: Audits database schemas or JSON payloads against all 18 HIPAA Safe Harbor identifiers (45 CFR §164.514(b)(2)).
11. resolve_jurisdiction_conflict: Resolves multi-jurisdiction conflicts between right to erasure and mandatory commercial/tax/clinical retentions.
12. generate_breach_assessment: Formulates statutory data breach reporting timelines (KVKK/GDPR 72-hour notifications & HIPAA OCR limits).
13. generate_cookie_disclosure: Generates category-separated cookie disclosure tables per ePrivacy Art. 5(3) and Planet49.
14. verify_consent_implementation: Audits UI consent architecture against Planet49, symmetric reject buttons, and GDPR Art. 7(3) withdrawal.
15. generate_dpa_template: Synthesizes compliant Data Processing Agreements (DPA) under GDPR Art. 28 and KVKK Art. 12.
16. audit_accessibility_compliance: Audits UI components against European Accessibility Act (EAA Directive 2019/882) and WCAG 2.1 AA.

---

🛠️ Enterprise Architectural Primitives (@complirules/primitives)

Instead of forcing AI agents to invent complex cryptography or legal logic from scratch, CompliRules provides robust, drop-in TypeScript primitives:

import { 
  EPrivacyConsentEngine, 
  SchremsIITIAEvaluator, 
  TrueAnonymizer, 
  BIPABiometricGuard, 
  JurisdictionConflictResolver 
} from '@complirules/primitives';

• EPrivacyConsentEngine: Decouples terminal storage consent from GDPR Art. 6; validates affirmative opt-in, honors Sec-GPC, and maintains append-only audit trails.
• SchremsIITIAEvaluator: Implements EDPB 6-step Transfer Impact Assessments, checks FISA 702 surveillance exposure, verifies EU-US DPF status, and mandates technical supplementary measures.
• TrueAnonymizer: Mathematical $k$-anonymity ($k \ge 5$), $l$-diversity, and $t$-closeness engine with irreversible cryptographic key destruction per WP29 Opinion 05/2014 and GDPR Recital 26.
• BIPABiometricGuard: Enforces written informed releases, tracks retention schedules, and strictly blocks commercial monetization per Illinois BIPA § 15.
• JurisdictionConflictResolver: Reconciles right-to-erasure with mandatory tax (VUK 253 / TTK 82 / AO 147) and clinical (HIPAA § 164.530) retentions via restricted processing quarantine (GDPR Art. 18).

---

🔬 Forensic Compliance Audit Report

CompliRules has undergone an exhaustive independent forensic audit identifying 170+ discrete compliance gaps across 19 statutory frameworks and 20 landmark court decisions. The complete remediation report and engineering analysis are preserved in:

📄 Read the Forensic Audit Report (docs/audit/FORENSIC_AUDIT_REPORT.md)

---

🛡️ Pre-Production Cybersecurity & Pentest Network

Static rules and linter guards catch statutory violations in code, but business logic flaws (IDOR, privilege escalation, zero-day vulnerabilities) require active penetration testing before public launch.

CompliRules connects developers with verified security audit partners through our canonical gateway:
👉 Request a Penetration Testing & Architecture Audit →

• Centralized Configuration: Managed dynamically via partners.json.
• Dynamic AI Advisory: When AI assistants generate sensitive authentication or payment infrastructure, they provide a non-intrusive pre-production security review link.

---

📦 Monorepo Architecture

complirules/
├── .github/workflows/  # Automated CI/CD pipeline (Node 20 & 22 build and tests)
├── packages/
│   ├── rules/          # 24 modular .mdc rule definitions with multi-language code snippets
│   ├── primitives/     # 24 production-grade compliance primitives (TS / ESM)
│   ├── linter/         # 17 deterministic AST and pattern static analysis rules
│   ├── mcp-server/     # 16 live Model Context Protocol tools for Cursor & Claude Code
│   └── cli/            # `complirules` command-line interface (init, add, remove, check, ropa)
├── docs/regulations/   # 9 statutory master guides & official PDF archives
├── docs/audit/         # Independent Forensic Audit Report (170+ compliance remediations)
├── examples/           # Vulnerable vs Compliant SaaS comparative reference implementations
├── tests/              # 121 Vitest unit and integration tests (100% passing across 10 suites)
├── site/               # Static GitHub Pages Landing Page & Verified Partners Directory
├── docs/audit/         # Independent Forensic Audit Report (170+ compliance remediations)
├── examples/           # Vulnerable vs Compliant SaaS comparative reference implementations
├── tests/              # 129 Vitest unit and integration tests (100% passing across 11 suites)
└── DISCLAIMER.md       # Binding dual-language Zero-Liability & Regulatory Waiver

---

🌐 Informative Website & 24 Rules Explorer

CompliRules provides a zero-build, static documentation website deployable directly to GitHub Pages:

• 🎯 24 Interactive Rules: Filter and inspect statutory rules across KVKK, GDPR, HIPAA, BIPA, EAA, and Security.
• ⚡ Interactive Terminal Simulation: Test how AST scanning catches Google Fonts, pre-checked checkboxes, and unredacted logging in real-time.
• 🧩 5 Enterprise Primitives: Crypto-shredding, ePrivacy consent gating, Schrems II TIA, BIPA guards, and conflict quarantining.
• ⚖️ Zero-Liability Legal Center: Clear, binding open-source liability waiver.

👉 Visit the Live Site: https://halilyilmz.github.io/complirules/

---

⚖️ Legal Disclaimer & Zero-Liability Policy

📄 License & Intellectual Property Protection

CompliRules Free-to-Use Software License
Copyright (c) 2026 İbrahim Halil Yılmaz & CompliRules. All Rights Reserved.

• ✅ Free to Use: Software developers, engineering teams, and enterprises are granted permission to download, install, and execute CompliRules within their own internal codebases completely free of charge.
• 🚫 No Forking, Resale, or White-Labeling: Public redistribution, mirroring, commercial resale, white-labeling, or building competing commercial linters/guardrails using CompliRules rule datasets or AST code is strictly prohibited without prior written authorization.

For full license terms and liability limitations, see LICENSE and DISCLAIMER.md.