About Regulane compliance check
Regulane compliance check is a code-compliance tool for coding agents. It checks code against 34 secure-coding rules and returns a scorecard with severity, affected controls, and fixes; the agent reads code locally, and free checks are not stored.
Key features
- 01Check against 34 secure-coding rules
- 02Map rules to ISO 27001 controls
- 03Relate personal-data rules to DPDP Act 2023
- 04Return findings, severity, controls, and fixes
- 05Code is read locally by the agent
Use cases
- 01Check a repository for secure-coding issues
- 02Review controls affected by findings
- 03Apply fixes and run another check
MCP support
The project connects coding agents to Regulane's hosted MCP server to retrieve rules and submit check results; the server returns a scorecard.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://regulane.com/api/mcpclaude mcp add --transport http com-regulane-compliance https://regulane.com/api/mcp{"mcpServers":{"com-regulane-compliance":{"type":"http","url":"https://regulane.com/api/mcp"}}}Open in Cursor{"servers":{"com-regulane-compliance":{"type":"http","url":"https://regulane.com/api/mcp"}}}Open in VS Code{"mcpServers":{"com-regulane-compliance":{"type":"http","url":"https://regulane.com/api/mcp"}}}{"mcpServers":{"com-regulane-compliance":{"serverUrl":"https://regulane.com/api/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project READMERegulane for coding agents
A free compliance check inside the coding agent you already use. Your agent checks your code against Regulane's 34 secure-coding rules, each mapped to ISO/IEC 27001:2022 Annex A controls and, for personal data, the DPDP Act 2023, and you get back a scorecard: findings by severity, the controls they affect, and the fix for each.
Regulane never receives your code. Your agent reads it on your machine and reports only file paths, line numbers and one-sentence findings. No account is needed, and a free check is not stored.
More: regulane.com/coding-agents
Use it
Ask your agent:
Check this repository with Regulane.
The agent calls get_compliance_rules, reviews the code in scope, then calls report_compliance_check and shows you the scorecard. It can then make the fixes and check again. In Claude Code the skill is also available as /regulane:compliance-check.
Install
This repository is a plugin for Claude, Codex and Cursor, and an extension for Gemini CLI. Each loads the same MCP server, https://regulane.com/api/mcp, and the same skill.
| Agent | Install |
|---|---|
| Claude Code | /plugin marketplace add siddhantmallah/regulane-agent-plugin, then /plugin install regulane@regulane |
| Gemini CLI | gemini extensions install https://github.com/siddhantmallah/regulane-agent-plugin |
| Codex, Cursor, Claude (app) | From each product's plugin directory, once listed |
Or add only the MCP server, with no plugin:
claude mcp add --transport http regulane https://regulane.com/api/mcp
codex mcp add regulane --url https://regulane.com/api/mcp
gemini mcp add --transport http regulane https://regulane.com/api/mcp
Setup for VS Code, Cursor, Windsurf and other agents: regulane.com/coding-agents#setup.
What is in this repository
| Path | For |
|---|---|
skills/compliance-check/SKILL.md | The skill every agent follows: scope, rules, report, scorecard |
.claude-plugin/ | Claude plugin manifest and Claude Code marketplace |
.codex-plugin/ | Codex plugin manifest |
.cursor-plugin/, mcp.json | Cursor plugin manifest and MCP config |
.mcp.json | MCP config for Claude and Codex |
gemini-extension.json, GEMINI.md | Gemini CLI extension |
server.json | Listing in the official MCP Registry (com.regulane/compliance) |
There is no code to install: only Markdown and JSON pointing at the hosted server.
Data
What your agent sends to regulane.com: the repository name or address (any credentials in it are removed), branch, commit, which agent ran the check, one line describing the scope, the rule ids checked, and for each finding a file path, line number and one sentence. Anything that looks like a secret, an email address, or a card, Aadhaar or PAN number is replaced on arrival. A free check is turned into a scorecard, sent back, and not stored.
Teams can keep every check as audit evidence by connecting a Regulane workspace with an agent token; those checks are kept in the workspace. See the privacy notice, section 4c.
What it is not
A clean scorecard means your agent checked the code it was given against these rules and found nothing. It is not a certification, an audit opinion or a penetration test, and Regulane does not run or scan your code itself.
Support
[email protected] · regulane.com/contact
License
MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.