RuleMesh MCP

Connect from Codex, Claude Code, Gemini CLI, Cursor, or another Streamable HTTP coding agent. Start with a read-only access check, then pull requirements, inspect your repository locally, and report file-level evidence signals.

Connect your agent

Add the RuleMesh endpoint to your client. Use OAuth for an interactive session or an API key for CI and other non-interactive work.

Prove the connection first

Start with a read-only preview. It lists the regulations your account can reach and shows the next relevant module without reading repository files, opening a scan, or writing evidence. Continue only when the preview is useful.

1. Step 1

   Connect RuleMesh

   Add the server with OAuth or an API key.

   See setup
2. Step 2

   Preview read-only

   Confirm access and see the next module. Nothing is written.

   Use connection check
3. Step 3

   Run a baseline

   Inspect one module and record what the agent confirms.

   Use baseline prompt

Choose the next job

The first three choices cover most first visits. Open the complete library when you have a Jira module, interrupted session, applicability question, or narrower audit.

Use the RuleMesh MCP server to confirm the connection and preview what it can help with in this repository.

1. Call list_regulations and show which regulations this account can access.
2. Choose the first accessible regulation and call get_compliance_plan.
3. Show the highest-priority module returned, its risk summary, and what the baseline would do next with pull_rules.
4. Stop after the preview and ask whether I want to run the baseline scan.

Do not start a scan. Do not inspect or edit repository files. Do not submit evidence. Do not change RuleMesh or Jira state.

Code stays local. Your coding agent reads the repository and evaluates the requirements. RuleMesh receives evidence descriptions and the file names where signals were found; it does not access or upload the source files.

Configuration

The public setup contract is OAuth-first. API keys remain available for automation, CI, and clients that do not yet implement MCP OAuth.

codex mcp add rulemesh --url https://api.rulemesh.com/mcp
codex mcp login rulemesh

[mcp_servers.rulemesh]
url = "https://api.rulemesh.com/mcp"
env_http_headers = { "X-Api-Key" = "RULEMESH_API_KEY" }

claude mcp add --transport http rulemesh https://api.rulemesh.com/mcp

claude mcp add --transport http rulemesh https://api.rulemesh.com/mcp --header "X-Api-Key: rm_YOUR_KEY_HERE"

{
  "mcpServers": {
    "rulemesh": {
      "httpUrl": "https://api.rulemesh.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "rulemesh": {
      "httpUrl": "https://api.rulemesh.com/mcp",
      "headers": {
        "X-Api-Key": "rm_YOUR_KEY_HERE"
      }
    }
  }
}

{
  "mcpServers": {
    "rulemesh": {
      "transport": "http",
      "url": "https://api.rulemesh.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "rulemesh": {
      "transport": "http",
      "url": "https://api.rulemesh.com/mcp",
      "headers": {
        "X-Api-Key": "rm_YOUR_KEY_HERE"
      }
    }
  }
}

{
  "mcpServers": {
    "rulemesh": {
      "serverUrl": "https://api.rulemesh.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "rulemesh": {
      "serverUrl": "https://api.rulemesh.com/mcp",
      "headers": {
        "X-Api-Key": "rm_YOUR_KEY_HERE"
      }
    }
  }
}

{
  "servers": {
    "rulemesh": {
      "type": "http",
      "url": "https://api.rulemesh.com/mcp"
    }
  }
}

{
  "servers": {
    "rulemesh": {
      "type": "http",
      "url": "https://api.rulemesh.com/mcp",
      "headers": {
        "X-Api-Key": "rm_YOUR_KEY_HERE"
      }
    }
  }
}

Implementation Workflow

Evidence Signals

{
  "bundle_id": "access-control-security",
  "requirement_id": "itreq-gdpr-art-32-para-1-req-1",
  "evidence_submissions": [
    {
      "type": "code",
      "signal_suffix": "-implementation",
      "example_signal": "encryption-at-rest-implementation"
    },
    {
      "type": "test",
      "signal_suffix": "-test-coverage",
      "example_signal": "encryption-at-rest-test-coverage"
    }
  ],
  "min_count": 2,
  "_hint": "Call submit_signals once per file you changed or created."
}

Sensitivity Scaling

Compliance Scanning

Scope Interview

A deterministic, citation-grounded scoping interview that answers "what regulations apply to me?" before you start implementation work. Supported regulations: EU AI Act (32024R1689) and GDPR (32016R0679).

The user answers plain factual questions; a deterministic engine derives the legal classification with citations and confidence scores. Every verdict is informational only — citation-backed, advisory, and never a compliance guarantee. High-stakes outcomes set requiresHumanConfirmation=true.

Troubleshooting