JuriSync Documentation
A development-time cross-jurisdictional compliance orchestration layer and Model Context Protocol (MCP) server for AI-assisted software engineering.
As developers build AI-enabled features using autonomous coding agents (Claude Desktop, Cursor, Antigravity), systems are deployed across international borders without automated visibility into regulatory divergence. A system built in the US may function fine under voluntary guidelines like the NIST AI RMF 1.0, but upon international release trigger mandatory high-risk conformity assessments under EU AI Act Annex III, or violate India's DPDP Act Section 8(7) data erasure rules.
Discovering these non-conformities during post-launch legal reviews forces costly architectural rewrites, schema overhauls, or regulatory fines. JuriSync shifts regulatory evaluation left into the earliest design phase before code leaves your editor.
Generic generative LLMs are prone to legal hallucinationsโinventing statutory clauses, quoting repealed directives, and conflating voluntary best practices with legally binding mandates. JuriSync replaces ungrounded text with a deterministic evaluation pipeline backed by verified government gazette citations.
Quickstart in 5 Minutes
JuriSync can be utilized in three primary modalities:
Modality 1: Interactive Web Console
Visit the live interactive console at https://jurisync-one.vercel.app/. Enter a natural language feature description (or select one of the 4 preset scenarios) and press Ctrl + Enter to generate an instant regulatory blueprint.
Modality 2: Zero-Install MCP Server (`npx`)
Connect JuriSync directly to Claude Desktop, Cursor, or any agentic IDE with zero cloning:
{
"mcpServers": {
"jurisync": {
"command": "npx",
"args": ["-y", "jurisync"]
}
}
}
Modality 3: Terminal Headless Stdio Call
Execute the compliance pipeline from any shell via stdio:
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"analyze_compliance","arguments":{"feature_description":"AI system filtering resume CVs in EU and India"}}}' | npx -y jurisync
Core Engineering Principles
1. Deterministic Rule Matching
Every finding emitted by JuriSync corresponds to a deterministic rule object containing exact statutory citations (e.g. eu_ai_act_employment_high_risk, in_dpdp_retention_erasure_mandate). Rules are curated and mapped to statutory triggers (`employment`, `biometric`, `health`, `autonomous_action`, `personal_data`, `children`).
2. Binding vs. Voluntary Stratification
Regulatory confusion often stems from treating voluntary guidance as binding law, or vice-versa. JuriSync strictly classifies all output:
- [BINDING LEGISLATION]: Enacted statutes carrying legal enforcement mechanisms, statutory damages, or regulatory fines (e.g., EU AI Act, GDPR, India DPDP Act 2023, NYC Local Law 144, Illinois BIPA).
- [VOLUNTARY FRAMEWORK]: Industry risk management standards and federal guidance (e.g., NIST AI RMF 1.0, EEOC guidance).
3. Zero-Egress Privacy Architecture
JuriSync is engineered with zero remote telemetry. Web console analyses run client-side in the browser; MCP stdio queries run locally in Node.js. No developer prompts, proprietary feature descriptions, or candidate resumes are ever transmitted to third-party servers.
npm Package & CLI Specification
JuriSync is distributed on the official npm registry as jurisync (v1.1.0).
- Zero Dependencies: Built entirely with standard Node.js libraries. No runtime dependency vulnerabilities.
- Ultra-Lightweight: 74.3 kB tarball on registry (276.5 kB unpacked). Installs and executes in under 2 seconds.
- Dual-Mode: Functions both as an executable binary (
npx jurisync) and an ES Module programmatic SDK.
# Install locally in a project
npm install jurisync
# Or run instantly via npx without installing
npx -y jurisync
Model Context Protocol (MCP) Setup
The Model Context Protocol (MCP v1.0) is an open specification enabling AI coding assistants to invoke external tools over JSON-RPC 2.0 stdio pipes.
Claude Desktop Configuration
Locate your configuration file:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"jurisync": {
"command": "npx",
"args": ["-y", "jurisync"]
}
}
}
Cursor IDE Configuration
In Cursor, navigate to Cursor Settings โ Features โ MCP and click Add New MCP Server:
- Name:
jurisync - Type:
command - Command:
npx -y jurisync
Node.js SDK Usage
Use JuriSync directly in your CI/CD linters, GitHub Actions, or backend compliance microservices:
import { orchestrateCompliance } from 'jurisync';
const feature = 'Automated candidate screening tool using CV parsing and facial video interview analysis in the EU and India';
// Run central compliance orchestration pipeline
const report = orchestrateCompliance(feature);
console.log('Signals Detected:', report.signals.tags.map(t => t.label));
console.log('EU Rules Triggered:', report.guidance.EU.rules.length);
console.log('India Rules Triggered:', report.guidance.IN.rules.length);
console.log('Cross-Border Tensions:', report.tensions.map(t => t.title));
// Export Markdown action checklist for GitHub PR
console.log(report.checklist);
5-Stage Orchestration Pipeline
When a query is received, JuriSync executes five deterministic stages in sequence (< 5ms total execution latency):
- Signal Extraction (
signalExtractor.js): Parses text for token patterns, domain triggers, autonomous decision indicators, compound clause negations, and confidence scoring. - Statutory Rule Matching (
ruleEngine.js): Filters the 32 curated statutory rules against active signals across EU, India, and US. - Jurisdiction Synthesis (
knowledgeBase.js): Computes risk tiers (High Risk vs. Standard) and contextualizes obligations. - Tension Detection (
tensionEngine.js): Evaluates potential frictions between conflicting statutory mandates across borders with severity and likelihood metrics. - Checklist Synthesis (
orchestrator.js): Merges findings into grouped Markdown tasks ready for developer PRs and sprint tracking.
Risk Signal Extraction Radar (15 Signal Domains)
The signal engine detects 15 granular regulatory risk classes with phrase n-gram matching, compound clause negation handling (e.g., "does not process biometrics or facial scans"), and a 0โ100% confidence rating:
| Signal ID | Domain Label | Key Lexical Indicators | Key Regulatory Impact |
|---|---|---|---|
ai_decision |
AI-Assisted Decisions | ai, llm, gpt, model, machine learning, scoring |
Triggers EU AI Act scoping and FTC Act deceptive claims rules. |
personal_data |
Personal Data (PII) | user, email, profile, resume, candidate, data |
Triggers GDPR lawful basis and India DPDP Data Fiduciary duties. |
biometric |
Biometric / Facial Data | facial, selfie, biometric, face, voiceprint, embedding |
Triggers GDPR Art. 9 Special Category bans and Illinois BIPA releases. |
employment |
Employment / Hiring | hire, resume, cv, recruitment, applicant, candidate |
Triggers EU AI Act Annex III High-Risk classification and NYC LL144 AEDT audits. |
health |
Clinical / Health Records | medical, health, patient, clinical, symptom, diagnosis |
Triggers EU MDR / SaMD high-risk rules, HIPAA PHI safeguards, and India SPDI. |
autonomous_action |
Autonomous Decisions | automatic, solely, reject, filter, without human |
Triggers GDPR Art. 22 automated decision-making prohibition. |
children |
Minors & Children Data | child, children, minor, teen, school, under 18 |
Triggers India DPDP Sec. 9 tracking/monitoring bans and US COPPA. |
education |
Education & Vocational Assessment | student examination, automated grading, admission scoring, tutor |
Triggers EU AI Act Annex III Point 3 high-risk educational classification. |
infrastructure |
Critical Infrastructure | power grid, water supply, traffic control, industrial scada |
Triggers EU AI Act Annex III Point 2 critical infrastructure safety requirements. |
finance_credit |
Credit Risk & Underwriting | credit score, loan underwriting, creditworthiness, borrower |
Triggers EU AI Act Annex III Point 5(b), RBI Digital Lending, and US FCRA. |
emotion_biometric |
Emotion & Mood Recognition | emotion recognition, mood detection, facial expression analysis |
Triggers EU AI Act Article 5(1)(f) prohibited AI practices in workplaces/schools. |
law_enforcement |
Law Enforcement & Public Space | predictive policing, suspect, public camera, surveillance |
Triggers EU AI Act Annex III Point 6 law enforcement conformity assessments. |
cross_border |
Cross-Border Data Transfer | cross-border, international transfer, overseas hosting, offshore cloud |
Triggers India DPDP Sec. 16 blacklists, RBI data localization, and GDPR Chapter V. |
large_scale_data |
Significant Scale / Fiduciary | significant data fiduciary, millions of users, large scale |
Triggers India DPDP Sec. 10 DPO, Data Protection Impact Assessments, and independent audits. |
content_moderation |
Content Moderation & Synthetic Media | deepfake, content moderation, watermarking, synthetic media |
Triggers California AB 2013/3211 watermarking and India IT Rules due diligence. |
Cross-Border Tension Engine (6 Modeled Divergences)
The Tension Engine surfaces architectural friction where complying with one country's statutory obligation creates compliance challenges under another's, complete with severity ratings and engineering explorations:
US NYC Local Law 144 & EEOC: Requires employers to retain candidate scoring distributions and evaluation logs to conduct annual independent bias audits.
India DPDP Act Section 8(7): Mandates complete erasure of applicant personal data as soon as the recruitment purpose is satisfied, subject to a statutory legal-compliance exception.
Architectural Resolution: Decouple direct applicant identity data from pseudonymized statistical scoring distributions to satisfy both auditability and erasure duties simultaneously.
US FTC Section 5 Enforcement: Mandates permanent destruction of AI models and weights trained on non-consensual consumer data (e.g. Everalbum, Kurbo orders).
EU AI Act Articles 12 & 72: Requires continuous post-market traceability, version event logging, and unbroken lineage of high-risk models.
Architectural Resolution: Utilize modular parameter adapters (LoRA) or decoupled RAG vector stores so training subsets can be pruned without destroying core foundation model audit trails.
Curated Statutory Coverage Matrix (32 Rules)
Every rule in JuriSync is verified against official government publications. Filter by jurisdiction below:
| Jurisdiction | Status | Statutory Instrument | Regulatory Finding | Required Developer Action | Gazette Source |
|---|
Model Context Protocol (MCP) Tool Reference
JuriSync exposes three standard JSON-RPC 2.0 tools over stdio:
1. analyze_compliance
Runs the complete orchestration pipeline on a natural language feature description.
{
"name": "analyze_compliance",
"arguments": {
"feature_description": "An AI recruitment system that parses employee resumes and scores candidates for interview rejection in the EU and India.",
"jurisdictions": ["EU", "IN", "US"] // Optional, defaults to all
}
}
2. get_statutory_rule
Retrieves the full statutory citation, legal classification, and developer action for a specific rule ID.
{
"name": "get_statutory_rule",
"arguments": {
"rule_id": "eu_ai_act_employment_high_risk"
}
}
3. list_supported_regulations
Lists all 15 tracked international statutory instruments and regulatory bodies.
Responsible AI & Governance Framework
Compliance automation requires strict architectural ethics:
- Decision Support vs. Replacement: JuriSync is designed for engineers and architects to flag risks during sprint planning. It empowers informed dialogue with legal counsel.
- Human-in-the-Loop Safeguards: Where AI makes automated evaluations affecting individuals, JuriSync enforces oversight mechanisms per GDPR Art. 22 and EU AI Act Art. 14.
- Data Minimization: The system processes only the natural language feature description provided. No system code, applicant PII, or internal credentials are required or ingested.
JuriSync is an automated technical decision-support and regulatory intelligence tool intended to assist software developers, system architects, and AI engineers in identifying potential compliance considerations during early-stage software design. It does not provide formal legal advice, legal representation, or a guarantee of compliance. All findings and classifications are illustrative and must be validated by qualified legal counsel admitted to practice in the relevant jurisdictions prior to deployment.
Engineering Roadmap (6 Phases)
The ongoing development roadmap includes:
Phase 1: Static Codebase & AST Compliance Scanning
Building AST static analyzers using Tree-sitter to inspect source code repositories directly for biometric libraries (face-api.js), automated decision branches lacking human oversight, and database models lacking automatic TTL erasure routines.
Phase 2: SMT / Z3 Formal Verification of Conflicts
Mathematical modeling of statutory constraints to compute formal satisfiability proofs for multi-jurisdiction data architectures.
Phase 3: Expanded Global Regulatory Coverage
Incorporating Singapore PDPA & AI Verify, Japan APPI, South Korea PIPA, Brazil LGPD, California SB 1047, and Canada AIDA.
Phase 4: GitHub Action CI/CD Gatekeeper
A lightweight jurisync-action that inspects Pull Request descriptions and diffs, posting automated compliance feedback before merging.
Phase 5: EU AI Act Annex IV Conformity Dossier Generator
Compiles machine-readable compliance dossiers in JSON-LD signed cryptographically with Sigstore / Cosign.
Phase 6: Multi-Tenant Enterprise Policy DSL
A declarative YAML/JSON DSL enabling enterprise governance teams to define custom internal ethical boundaries alongside public statutes.