Content
# Privacy Law Scholar — MCP Knowledge Base
A local privacy law research and study tool built on a custom scraping pipeline, ChromaDB vector database, and a Model Context Protocol (MCP) server integrated with Claude Desktop.
Built by a self-directed privacy law student pursuing CIPP/E and AIGP certification — as a replacement for textbooks.
---
## The Problem
The standard approach to CIPP/E preparation is a textbook and practice questions. The textbook is good. But it's static — it gives you the law as a flat document. It doesn't show you how regulators actually apply it. It doesn't let you ask "what happened in every case where Article 17 was invoked against a tech company, and what did the DPA conclude?" It doesn't cross-reference GDPR, DPDPA, and EDPB guidance simultaneously in a single query.
For that, you'd need to read thousands of enforcement decisions scattered across nine regulatory bodies in multiple languages and inconsistent formats. Nobody does that manually.
This tool does it automatically. Ask a question in plain English, get cited results from legislation, regulatory guidance, and real enforcement cases — all at once.
---
## Demo
*Querying "consent under GDPR" returns Article 7, relevant recitals, EDPB guidance, and real enforcement cases — simultaneously, with full citations.*
---
## What It Does
Gives Claude Desktop semantic search over 4,090 privacy law documents including:
- **Full legislative text** — GDPR, EU AI Act, DPDPA (article by article)
- **Regulatory guidance** — EDPB guidelines, ICO guidance, DPC Ireland decisions
- **National DPA enforcement** — CNIL (France), AEPD (Spain), Garante (Italy), BfDI (Germany)
- **3,493 enforcement cases** — Every GDPRhub case with DPA, country, article, outcome, and fine metadata
Cross-law queries work simultaneously. Ask about consent and get GDPR Article 7, DPDPA Section 6, EDPB guidance, and real enforcement cases — all in one response, all cited.
---
## Architecture
```
Scraping Pipeline → ChromaDB (local vector DB) → MCP Server → Claude Desktop
```
**Scraping layer** (`scraper/`)
- `eurlex.py` — EUR-Lex CELLAR API for GDPR and EU AI Act
- `indiacode.py` — IndiaCode for DPDPA (PDF extraction)
- `gdprhub.py` — GDPRhub MediaWiki API (3,493 enforcement cases)
- `edpb.py` — EDPB guidelines and opinions
- `ico.py` — ICO guidance and enforcement
- `dpc.py` — DPC Ireland decisions
- `cnil.py` — CNIL (Playwright for JS rendering)
- `aepd.py` — AEPD Spain (Playwright + Cloudflare handling)
- `garante.py` — Garante Italy (Playwright)
**PDF handling** (`pdf_handler.py`)
- PyMuPDF for digital PDFs
- Tesseract OCR fallback for scanned documents
**Database** (`database.py`)
- ChromaDB — local, persistent, file-based
- Embeddings via `sentence-transformers/all-MiniLM-L6-v2`
- Metadata schema: law, article, domain, source_url, doc_type
- Enforcement cases additionally tagged: DPA, country, outcome, fine, case_title
- Domain mapping aligned to CIPP/E exam domains
**MCP Server** (`server.py`)
- Low-level MCP SDK implementation for reliability
- Six tools: `privacy_search`, `privacy_get_article`, `privacy_search_cases`, `privacy_save_session`, `privacy_get_sessions`, `privacy_update_news`
- SQLite session memory — persistent across conversations, retrievable in future sessions for continuity
- News updater — fetches from EDPB, ICO, and IAPP; checks existing database before storing, no duplicates ever added
---
## Stack
| Component | Tool |
|---|---|
| Scraping | Python, BeautifulSoup, Playwright, httpx |
| PDF extraction | PyMuPDF, Tesseract OCR |
| Vector database | ChromaDB |
| Embeddings | sentence-transformers (all-MiniLM-L6-v2) |
| Session memory | SQLite |
| MCP server | Python MCP SDK (low-level Server) |
| Client | Claude Desktop |
**Total cost: £0.** Every component is free and runs locally.
---
## Sources
| Source | Content | Method |
|---|---|---|
| EUR-Lex (CELLAR API) | GDPR, EU AI Act | Official API |
| IndiaCode | DPDPA | PDF extraction |
| GDPRhub | 3,493 enforcement cases | MediaWiki API |
| EDPB | Guidelines, opinions, recommendations | BeautifulSoup + PDF |
| ICO | UK GDPR guidance and enforcement | BeautifulSoup + PDF |
| DPC Ireland | Decisions (Meta, Google, TikTok) | BeautifulSoup + PDF |
| CNIL France | Decisions and guidance | Playwright |
| AEPD Spain | Decisions and guidance | Playwright |
| Garante Italy | Decisions and guidance | Playwright |
---
## Setup
### 1. Install dependencies
```bash
pip install beautifulsoup4 playwright pymupdf pytesseract chromadb sentence-transformers requests httpx mcp
python -m playwright install
```
Install Tesseract separately: [UB-Mannheim build for Windows](https://github.com/UB-Mannheim/tesseract/wiki)
### 2. Update paths
In `server.py` and `database.py`, update `BASE_DIR` to your local path:
```python
BASE_DIR = Path(r"C:\your\path\to\legal-scraper")
```
### 3. Build the database
```bash
python main.py
```
This runs all scrapers and populates ChromaDB. Takes 30–60 minutes on first run.
### 4. Configure Claude Desktop
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"privacy_law": {
"command": "python",
"args": ["C:\\your\\path\\to\\legal-scraper\\server.py"],
"env": {
"PYTHONPATH": "C:\\path\\to\\python\\site-packages"
}
}
}
}
```
### 5. Restart Claude Desktop
The MCP connects automatically on startup. Test with:
```
Use the privacy_ping tool
```
---
## MCP Tools
| Tool | Description |
|---|---|
| `privacy_search` | Semantic search across all 4,087 documents |
| `privacy_get_article` | Get a specific article e.g. Article 17 GDPR |
| `privacy_search_cases` | Search enforcement cases with filters by article, country, or DPA |
| `privacy_save_session` | Save session summary to persistent memory — say "save session" to trigger |
| `privacy_get_sessions` | Retrieve past session context for continuity across conversations |
| `privacy_update_news` | Fetch latest privacy law news from EDPB, ICO, IAPP — deduplicates automatically |
---
## Why No AI Model in the Pipeline
The scraper pipeline is entirely rule-based. No AI model was used to process or tag documents because:
- Legal text has natural structure (Articles, Sections, Recitals) that a deterministic chunker handles more reliably than a model
- Metadata (article numbers, law names, DPA, country, outcome) is available directly from source structure
- Domain mapping is a static lookup table — it never changes
- Claude reads raw legal text accurately at query time without needing pre-generated summaries
The AI sits at the query end, not the ingestion end.
---
## Hardware
Built and tested on: Ryzen 5 5500H, RTX 2050 (4GB VRAM), 8GB RAM.
The embedding model (all-MiniLM-L6-v2) uses CPU only. The full database build runs without GPU.
---
## Licence
MIT — use it, fork it, build on it.
