Quickstart

Three clients, one URL. The gateway speaks MCP over HTTP at a single endpoint — https://gateway.ansvar.eu/mcp. There is no SDK to install and no API key to paste: auth is OAuth, in the browser, and your client registers itself via Dynamic Client Registration.

quickstart

Connect a client

claude desktop · claude.ai

Add a custom connector

Settings → Connectors → Add custom connector. OAuth runs in the browser: Dynamic Client Registration plus PKCE. Approve once, then ask.

Name: Ansvar
URL:  https://gateway.ansvar.eu/mcp

claude code

One command

Registers the gateway as an HTTP MCP server. The first tool call opens the consent flow.

claude mcp add --transport http ansvar https://gateway.ansvar.eu/mcp

The --transport http flag is required — without it the CLI defaults to stdio and the server name resolves against a binary that doesn't exist. Then start Claude, run /mcp, choose Authenticate.

cursor · vs code

One JSON block each

Same endpoint, same flow — but the two configs differ. Cursor reads ~/.cursor/mcp.json with an mcpServers key; VS Code (Copilot agents mode) reads .vscode/mcp.json with a servers key. They are not interchangeable.

Cursor — ~/.cursor/mcp.json:

{
  "mcpServers": {
    "ansvar": {
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

VS Code — .vscode/mcp.json:

{
  "servers": {
    "ansvar": {
      "type": "http",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

first tool call triggers the OAuth consent flow — tier comes from your account (Free / Premium / Team / Company)

Any MCP-capable client works — these are the ones we test every release. For ChatGPT, Continue, Open WebUI, and Copilot Studio see Setup.

The free tier is real (100 search calls/day, single-MCP scope) and exercises the full connect flow — sign up at pricing. Premium removes the daily quota and unlocks multi-source fan-out plus the legal evidence layer (case law, preparatory works, agency guidance). Workflow tools (gap_analysis, DPIA, threat modeling, tender review) are Team and Company tiers — see Your first gap analysis.

first session

The first answer carries its sources.

There is no LLM inside the gateway. It routes each call to the servers in scope, fans out in parallel, and returns results with citations attached. Your client reasons; the gateway supplies evidence.

Claude · connected to gateway.ansvar.eu

> What does DORA require for ICT incident classification?
→ search("ICT incident classification", jurisdictions=["EU"])
← eu-regulations · 200 · 3 items · 3 verified

Classify incidents by clients and counterparts affected, duration, geographic spread, data losses, criticality of the services affected, and economic impact.
DORA Art. 18(1)

Major incidents start the reporting chain: initial notification, intermediate report, final report.
DORA Art. 19(4)

fan-out · 4 of 368 servers in scope · max 10 concurrent · 15s budget · 3 verified · 0 unresolved — counts illustrative, fleet size live

citation contract

Every item arrives with its provenance.

the citation contract

The gateway does not paraphrase sources into anonymity. Each served item carries three fields, always:

_citation.source_url · where the text lives

_citation.publisher · who issued it

_citation.license · what you may do with it

Two envelopes travel with every payload: served source items carry _citation.* provenance, and synthesized claims carry the attribution through from the items they rest on — the citation block shown below. Failed lookups return errors — never silence. A claim the fleet cannot verify arrives marked unresolved, not papered over; see What is the gateway for the design rationale.

refusal discipline · unresolved beats invented

wire format

One claim, on the wire.

What your client receives. The claim and its anchor travel together — strip one and the other is useless by design.

citation envelope · one claim

{ "claim": "Incidents are classified by clients affected, duration, geographic spread, data losses, criticality, and economic impact",
  "citation": { "source": "dora", "article": "18(1)",
    "url": "https://eur-lex.europa.eu/eli/reg/2022/2554#art18",
    "verified": true } }

served items additionally carry _citation.source_url · _citation.publisher · _citation.license

tool reference

A small surface, on purpose.

Seven calls cover most sessions.

Tool	What it does
search	Full-text search across in-scope sources, routed by jurisdiction and sector. Every hit carries its citation.
get_provision	One provision, verbatim, at article level — with source URL, publisher, and license.
list_coverage	What is live right now: jurisdictions, sources, and counts, machine-readable.
validate_citation	Round-trips a citation against the source corpus before you rely on it — a deterministic, non-model check: article numbers resolve, anchors exist, the URL returns the cited text.
get_changes	Recorded changes to tracked instruments, for monitoring what moved and when.
describe_capabilities	The caller’s own view: tools, sources, and limits for the authenticated tier.
search_guidance	Agency guidance from regulators, alongside the statute — part of the legal evidence layer, paid tiers.

excerpt — run describe_capabilities for the live listing