JuriSync Documentation
โ† Web Console
๐Ÿ”
jurisync v1.0.1
Overview

JuriSync Documentation

A development-time cross-jurisdictional compliance orchestration layer and Model Context Protocol (MCP) server for AI-assisted software engineering.

As developers build AI-enabled features using autonomous coding agents (Claude Desktop, Cursor, Antigravity), systems are deployed across international borders without automated visibility into regulatory divergence. A system built in the US may function fine under voluntary guidelines like the NIST AI RMF 1.0, but upon international release trigger mandatory high-risk conformity assessments under EU AI Act Annex III, or violate India's DPDP Act Section 8(7) data erasure rules.

Discovering these non-conformities during post-launch legal reviews forces costly architectural rewrites, schema overhauls, or regulatory fines. JuriSync shifts regulatory evaluation left into the earliest design phase before code leaves your editor.

๐Ÿ’ก Why Not Just Ask an LLM?

Generic generative LLMs are prone to legal hallucinationsโ€”inventing statutory clauses, quoting repealed directives, and conflating voluntary best practices with legally binding mandates. JuriSync replaces ungrounded text with a deterministic evaluation pipeline backed by verified government gazette citations.

Quickstart

Quickstart in 5 Minutes

JuriSync can be utilized in three primary modalities:

Modality 1: Interactive Web Console

Visit the live interactive console at https://jurisync-one.vercel.app/. Enter a natural language feature description (or select one of the 4 preset scenarios) and press Ctrl + Enter to generate an instant regulatory blueprint.

Modality 2: Zero-Install MCP Server (`npx`)

Connect JuriSync directly to Claude Desktop, Cursor, or any agentic IDE with zero cloning:

claude_desktop_config.json
{
  "mcpServers": {
    "jurisync": {
      "command": "npx",
      "args": ["-y", "jurisync"]
    }
  }
}

Modality 3: Terminal Headless Stdio Call

Execute the compliance pipeline from any shell via stdio:

bash / zsh / PowerShell
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"analyze_compliance","arguments":{"feature_description":"AI system filtering resume CVs in EU and India"}}}' | npx -y jurisync
Governance & Philosophy

Core Engineering Principles

1. Deterministic Rule Matching

Every finding emitted by JuriSync corresponds to a deterministic rule object containing exact statutory citations (e.g. eu_ai_act_employment_high_risk, in_dpdp_retention_erasure_mandate). Rules are curated and mapped to statutory triggers (`employment`, `biometric`, `health`, `autonomous_action`, `personal_data`, `children`).

2. Binding vs. Voluntary Stratification

Regulatory confusion often stems from treating voluntary guidance as binding law, or vice-versa. JuriSync strictly classifies all output:

  • [BINDING LEGISLATION]: Enacted statutes carrying legal enforcement mechanisms, statutory damages, or regulatory fines (e.g., EU AI Act, GDPR, India DPDP Act 2023, NYC Local Law 144, Illinois BIPA).
  • [VOLUNTARY FRAMEWORK]: Industry risk management standards and federal guidance (e.g., NIST AI RMF 1.0, EEOC guidance).

3. Zero-Egress Privacy Architecture

JuriSync is engineered with zero remote telemetry. Web console analyses run client-side in the browser; MCP stdio queries run locally in Node.js. No developer prompts, proprietary feature descriptions, or candidate resumes are ever transmitted to third-party servers.

Packaging

npm Package & CLI Specification

JuriSync is distributed on the official npm registry as jurisync (v1.1.0).

๐Ÿ“ฆ Package Highlights
  • Zero Dependencies: Built entirely with standard Node.js libraries. No runtime dependency vulnerabilities.
  • Ultra-Lightweight: 74.3 kB tarball on registry (276.5 kB unpacked). Installs and executes in under 2 seconds.
  • Dual-Mode: Functions both as an executable binary (npx jurisync) and an ES Module programmatic SDK.
Install Globally or Locally
# Install locally in a project
npm install jurisync

# Or run instantly via npx without installing
npx -y jurisync
MCP Protocol

Model Context Protocol (MCP) Setup

The Model Context Protocol (MCP v1.0) is an open specification enabling AI coding assistants to invoke external tools over JSON-RPC 2.0 stdio pipes.

Claude Desktop Configuration

Locate your configuration file:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "jurisync": {
      "command": "npx",
      "args": ["-y", "jurisync"]
    }
  }
}

Cursor IDE Configuration

In Cursor, navigate to Cursor Settings โ†’ Features โ†’ MCP and click Add New MCP Server:

  • Name: jurisync
  • Type: command
  • Command: npx -y jurisync
Programmatic SDK

Node.js SDK Usage

Use JuriSync directly in your CI/CD linters, GitHub Actions, or backend compliance microservices:

index.js (ES Module)
import { orchestrateCompliance } from 'jurisync';

const feature = 'Automated candidate screening tool using CV parsing and facial video interview analysis in the EU and India';

// Run central compliance orchestration pipeline
const report = orchestrateCompliance(feature);

console.log('Signals Detected:', report.signals.tags.map(t => t.label));
console.log('EU Rules Triggered:', report.guidance.EU.rules.length);
console.log('India Rules Triggered:', report.guidance.IN.rules.length);
console.log('Cross-Border Tensions:', report.tensions.map(t => t.title));

// Export Markdown action checklist for GitHub PR
console.log(report.checklist);
Internals

5-Stage Orchestration Pipeline

When a query is received, JuriSync executes five deterministic stages in sequence (< 5ms total execution latency):

The 5-Stage Execution Flow
  1. Signal Extraction (signalExtractor.js): Parses text for token patterns, domain triggers, autonomous decision indicators, compound clause negations, and confidence scoring.
  2. Statutory Rule Matching (ruleEngine.js): Filters the 32 curated statutory rules against active signals across EU, India, and US.
  3. Jurisdiction Synthesis (knowledgeBase.js): Computes risk tiers (High Risk vs. Standard) and contextualizes obligations.
  4. Tension Detection (tensionEngine.js): Evaluates potential frictions between conflicting statutory mandates across borders with severity and likelihood metrics.
  5. Checklist Synthesis (orchestrator.js): Merges findings into grouped Markdown tasks ready for developer PRs and sprint tracking.
Signal Radar

Risk Signal Extraction Radar (15 Signal Domains)

The signal engine detects 15 granular regulatory risk classes with phrase n-gram matching, compound clause negation handling (e.g., "does not process biometrics or facial scans"), and a 0โ€“100% confidence rating:

Signal ID Domain Label Key Lexical Indicators Key Regulatory Impact
ai_decision AI-Assisted Decisions ai, llm, gpt, model, machine learning, scoring Triggers EU AI Act scoping and FTC Act deceptive claims rules.
personal_data Personal Data (PII) user, email, profile, resume, candidate, data Triggers GDPR lawful basis and India DPDP Data Fiduciary duties.
biometric Biometric / Facial Data facial, selfie, biometric, face, voiceprint, embedding Triggers GDPR Art. 9 Special Category bans and Illinois BIPA releases.
employment Employment / Hiring hire, resume, cv, recruitment, applicant, candidate Triggers EU AI Act Annex III High-Risk classification and NYC LL144 AEDT audits.
health Clinical / Health Records medical, health, patient, clinical, symptom, diagnosis Triggers EU MDR / SaMD high-risk rules, HIPAA PHI safeguards, and India SPDI.
autonomous_action Autonomous Decisions automatic, solely, reject, filter, without human Triggers GDPR Art. 22 automated decision-making prohibition.
children Minors & Children Data child, children, minor, teen, school, under 18 Triggers India DPDP Sec. 9 tracking/monitoring bans and US COPPA.
education Education & Vocational Assessment student examination, automated grading, admission scoring, tutor Triggers EU AI Act Annex III Point 3 high-risk educational classification.
infrastructure Critical Infrastructure power grid, water supply, traffic control, industrial scada Triggers EU AI Act Annex III Point 2 critical infrastructure safety requirements.
finance_credit Credit Risk & Underwriting credit score, loan underwriting, creditworthiness, borrower Triggers EU AI Act Annex III Point 5(b), RBI Digital Lending, and US FCRA.
emotion_biometric Emotion & Mood Recognition emotion recognition, mood detection, facial expression analysis Triggers EU AI Act Article 5(1)(f) prohibited AI practices in workplaces/schools.
law_enforcement Law Enforcement & Public Space predictive policing, suspect, public camera, surveillance Triggers EU AI Act Annex III Point 6 law enforcement conformity assessments.
cross_border Cross-Border Data Transfer cross-border, international transfer, overseas hosting, offshore cloud Triggers India DPDP Sec. 16 blacklists, RBI data localization, and GDPR Chapter V.
large_scale_data Significant Scale / Fiduciary significant data fiduciary, millions of users, large scale Triggers India DPDP Sec. 10 DPO, Data Protection Impact Assessments, and independent audits.
content_moderation Content Moderation & Synthetic Media deepfake, content moderation, watermarking, synthetic media Triggers California AB 2013/3211 watermarking and India IT Rules due diligence.
Tension Detection

Cross-Border Tension Engine (6 Modeled Divergences)

The Tension Engine surfaces architectural friction where complying with one country's statutory obligation creates compliance challenges under another's, complete with severity ratings and engineering explorations:

โš ๏ธ Classical Conflict 1: Candidate Audit Retention vs Erasure Mandates [HIGH SEVERITY]

US NYC Local Law 144 & EEOC: Requires employers to retain candidate scoring distributions and evaluation logs to conduct annual independent bias audits.
India DPDP Act Section 8(7): Mandates complete erasure of applicant personal data as soon as the recruitment purpose is satisfied, subject to a statutory legal-compliance exception.
Architectural Resolution: Decouple direct applicant identity data from pseudonymized statistical scoring distributions to satisfy both auditability and erasure duties simultaneously.

๐Ÿ›‘ Classical Conflict 2: Algorithmic Disgorgement vs Model Traceability [CRITICAL SEVERITY]

US FTC Section 5 Enforcement: Mandates permanent destruction of AI models and weights trained on non-consensual consumer data (e.g. Everalbum, Kurbo orders).
EU AI Act Articles 12 & 72: Requires continuous post-market traceability, version event logging, and unbroken lineage of high-risk models.
Architectural Resolution: Utilize modular parameter adapters (LoRA) or decoupled RAG vector stores so training subsets can be pruned without destroying core foundation model audit trails.

Curated Ruleset

Curated Statutory Coverage Matrix (32 Rules)

Every rule in JuriSync is verified against official government publications. Filter by jurisdiction below:

Jurisdiction Status Statutory Instrument Regulatory Finding Required Developer Action Gazette Source
API Reference

Model Context Protocol (MCP) Tool Reference

JuriSync exposes three standard JSON-RPC 2.0 tools over stdio:

1. analyze_compliance

Runs the complete orchestration pipeline on a natural language feature description.

analyze_compliance Input Schema
{
  "name": "analyze_compliance",
  "arguments": {
    "feature_description": "An AI recruitment system that parses employee resumes and scores candidates for interview rejection in the EU and India.",
    "jurisdictions": ["EU", "IN", "US"] // Optional, defaults to all
  }
}

2. get_statutory_rule

Retrieves the full statutory citation, legal classification, and developer action for a specific rule ID.

get_statutory_rule Input Schema
{
  "name": "get_statutory_rule",
  "arguments": {
    "rule_id": "eu_ai_act_employment_high_risk"
  }
}

3. list_supported_regulations

Lists all 15 tracked international statutory instruments and regulatory bodies.

Ethics & Trust

Responsible AI & Governance Framework

Compliance automation requires strict architectural ethics:

  • Decision Support vs. Replacement: JuriSync is designed for engineers and architects to flag risks during sprint planning. It empowers informed dialogue with legal counsel.
  • Human-in-the-Loop Safeguards: Where AI makes automated evaluations affecting individuals, JuriSync enforces oversight mechanisms per GDPR Art. 22 and EU AI Act Art. 14.
  • Data Minimization: The system processes only the natural language feature description provided. No system code, applicant PII, or internal credentials are required or ingested.
Future Scope

Engineering Roadmap (6 Phases)

The ongoing development roadmap includes:

Phase 1: Static Codebase & AST Compliance Scanning

Building AST static analyzers using Tree-sitter to inspect source code repositories directly for biometric libraries (face-api.js), automated decision branches lacking human oversight, and database models lacking automatic TTL erasure routines.

Phase 2: SMT / Z3 Formal Verification of Conflicts

Mathematical modeling of statutory constraints to compute formal satisfiability proofs for multi-jurisdiction data architectures.

Phase 3: Expanded Global Regulatory Coverage

Incorporating Singapore PDPA & AI Verify, Japan APPI, South Korea PIPA, Brazil LGPD, California SB 1047, and Canada AIDA.

Phase 4: GitHub Action CI/CD Gatekeeper

A lightweight jurisync-action that inspects Pull Request descriptions and diffs, posting automated compliance feedback before merging.

Phase 5: EU AI Act Annex IV Conformity Dossier Generator

Compiles machine-readable compliance dossiers in JSON-LD signed cryptographically with Sigstore / Cosign.

Phase 6: Multi-Tenant Enterprise Policy DSL

A declarative YAML/JSON DSL enabling enterprise governance teams to define custom internal ethical boundaries alongside public statutes.