About AI Act Radar
AI Act Radar examples is a collection of runnable webhook receivers for processing AI Act Radar events across several platforms. It is for developers integrating webhook delivery; the examples share signature verification and idempotency handling.
Key features
- 01Receivers for six platforms
- 02HMAC-SHA-256 signature verification
- 03Timestamp freshness checks
- 04Idempotency key handling
- 05Signed sample-event test scripts
Use cases
- 01Integrating AI Act Radar webhooks into a platform
- 02Testing signed webhook events locally
- 03Building receivers that safely handle retries
MCP support
The README describes webhook receiver examples, not an MCP server or MCP integration.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://mcp.aiactradar.com/mcp/v1claude mcp add --transport http com-aiactradar-ai-act-radar https://mcp.aiactradar.com/mcp/v1{"mcpServers":{"com-aiactradar-ai-act-radar":{"type":"http","url":"https://mcp.aiactradar.com/mcp/v1"}}}Open in Cursor{"servers":{"com-aiactradar-ai-act-radar":{"type":"http","url":"https://mcp.aiactradar.com/mcp/v1"}}}Open in VS Code{"mcpServers":{"com-aiactradar-ai-act-radar":{"type":"http","url":"https://mcp.aiactradar.com/mcp/v1"}}}{"mcpServers":{"com-aiactradar-ai-act-radar":{"serverUrl":"https://mcp.aiactradar.com/mcp/v1"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
https://mcp.aiactradar.com/mcp/v1Auth requiredTools
4| Parameter | Type | Required | Description |
|---|---|---|---|
| limit | integer | No | |
| since | string | No | ISO 8601 timestamp; only events published after this. Optional. |
| until | string | No | ISO 8601 timestamp; only events published before this. Optional. |
| topics | array | No | Topic taxonomy. e.g. ["gpai","transparency","high-risk"]. Optional. |
| source_id | string | No | One of: eurlex, aioffice, aiboard, codeofpractice, haveyoursay, cen, bnetza, bfdi, bsi, cnil, nl-algoritmeregister, oecdai. Optional. |
| severity_min | enum | No | Minimum severity. Optional.info | low | medium | high | critical |
Details
From the project READMEaiactradar-examples
Reference webhook receivers for AI Act Radar. Each subdirectory is a self-contained, runnable example for one platform.
What every receiver does
- Reads the raw request body (signature is over the bytes, not the parsed JSON).
- Verifies
X-AIAR-Timestampis within 300 seconds of now. - Verifies
X-AIAR-Signature(v1=<hex>) using HMAC-SHA-256 over<timestamp>.<raw_body>in constant time. - Checks an idempotency key (
event.id) before doing real work — retries are normal. - Returns 2xx within 5 seconds; otherwise the dispatcher retries with exponential backoff.
The verification is identical across platforms; only the platform glue differs.
Examples
| Folder | Platform | Notes |
|---|---|---|
cloudflare-workers/ | Cloudflare Workers | Web Crypto API, KV for idempotency |
vercel-edge/ | Vercel Edge Functions | Web Crypto API, Vercel KV for idempotency |
aws-lambda/ | AWS Lambda + API Gateway | Node crypto module, DynamoDB for idempotency |
express-node/ | Plain Express on Node | Node crypto, in-process LRU (replace for prod) |
fastify-typescript/ | Fastify + TS | Typed body parser, raw-body capture |
deno-deploy/ | Deno Deploy | Deno KV for idempotency |
Try it without signing up
Each example has a test.sh that signs a sample event with a local secret and posts it to the running receiver. You can run the full loop on your laptop in under five minutes:
cd cloudflare-workers
cp .dev.vars.example .dev.vars # set AIA_SECRET to anything
npm install && npm run dev # starts http://localhost:8787
# in another terminal:
bash test.sh # posts a signed sample event
Going to production
- Store
AIA_SECRETin your platform's secret manager. Never commit it. - Rotate the secret in the AI Act Radar dashboard at least every 90 days.
- Subscribe to the dispatcher's webhook health channel — bounced deliveries surface there before customers notice.
- Idempotency stores need a TTL of at least 7 days; the dispatcher retries up to 24h.
License
MIT.
AI Act Radar is operated by ligea GmbH, Karlsruhe. Information only — not legal advice.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.