movahedi.ca Privacy Data

ca.movahedi/privacyVersion 1.0.0

Canadian privacy enforcement, glossary, and Quebec Law 25 guidance for AI agents.

Status

Responds381 msNov 14, 2026, 13:41 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:41 UTC
Latency: 381 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://movahedi.ca/mcpResponds381 msNov 14, 2026, 13:41 UTC

No sign-in

Claude Code

claude mcp add --transport http privacy https://movahedi.ca/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: privacy
Remote MCP server URL: https://movahedi.ca/mcp

Cursor

{
  "mcpServers": {
    "privacy": {
      "url": "https://movahedi.ca/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"privacy","type":"http","url":"https://movahedi.ca/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

14 tools

Tools of movahedi.ca Privacy Data
	Description		Read-only	Idempotent	Open world
`canadian_privacy_breach_deadline_calculator_v1`Breach notification clocks for Canadian privacy regimes, verified against primary sources. Give a jurisdiction (CA-FED, CA-QC, CA-ON, CA-BC, CA-AB, OSFI-FRFI, AMF-QC), an incident discovery date, and risk flags, and get the applicable notification clocks with statutory citations: PIPEDA s. 10.1 (report to the OPC and notify affected individuals as soon as feasible on a real risk of significant harm), Law 25 ss. 3.5 to 3.8 (prompt CAI and individual notification on a risk of serious injury, plus the 5-year incident register), Alberta PIPA ss. 34.1 and 37.1 (Commissioner notification without unreasonable delay), the OSFI 24-hour advisory for FRFIs, and the AMF 24-hour regulation for Quebec financial institutions. Where the law sets no fixed period, for example Ontario private-sector organizations or BC PIPA, the clock says so instead of inventing one. Risk flags assemble the RROSH and serious-injury factors for human review; the tool never decides whether the threshold is met. Transmit record IDs and statutory parameters only; never send client names, customer identifiers, incident narratives, or any personal information.	Breach notification clocks for Canadian privacy regimes, verified against primary sources. Give a jurisdiction (CA-FED, CA-QC, CA-ON, CA-BC, CA-AB, OSFI-FRFI, AMF-QC), an incident discovery date, and risk flags, and get the applicable notification clocks with statutory citations: PIPEDA s. 10.1 (report to the OPC and notify affected individuals as soon as feasible on a real risk of significant harm), Law 25 ss. 3.5 to 3.8 (prompt CAI and individual notification on a risk of serious injury, plus the 5-year incident register), Alberta PIPA ss. 34.1 and 37.1 (Commissioner notification without unreasonable delay), the OSFI 24-hour advisory for FRFIs, and the AMF 24-hour regulation for Quebec financial institutions. Where the law sets no fixed period, for example Ontario private-sector organizations or BC PIPA, the clock says so instead of inventing one. Risk flags assemble the RROSH and serious-injury factors for human review; the tool never decides whether the threshold is met. Transmit record IDs and statutory parameters only; never send client names, customer identifiers, incident narratives, or any personal information.	No	Yes	Yes	No
`canadian_privacy_consequential_action_lookup_v1`Look up the twelve consequential actions in the Canadian privacy corpus v2026.12.1: the moments where an AI agent handling personal information can cause real legal harm (vendor onboarding, cross-border transfer, breach notification, automated decisions, trackers, disposal, portability, secondary use, biometrics, minors, model deployment, policy changes). Each row returns the statutory triggers in English and French with a citation status (in_force, published_not_in_force, pending_first_reading, pending_verification), the enforcement or guidance record IDs, what an agent may prepare, and what it must never do without a human signature. Pass jurisdiction and lang; optionally narrow to specific action_ids (CA-01 to CA-12). Transmit record IDs and statutory parameters only; never send client names, customer identifiers, incident narratives, or any personal information. Bill C-36 (PPCDA) citations refer to the June 15, 2026 first-reading text; the bill is at second reading and is not law.	Look up the twelve consequential actions in the Canadian privacy corpus v2026.12.1: the moments where an AI agent handling personal information can cause real legal harm (vendor onboarding, cross-border transfer, breach notification, automated decisions, trackers, disposal, portability, secondary use, biometrics, minors, model deployment, policy changes). Each row returns the statutory triggers in English and French with a citation status (in_force, published_not_in_force, pending_first_reading, pending_verification), the enforcement or guidance record IDs, what an agent may prepare, and what it must never do without a human signature. Pass jurisdiction and lang; optionally narrow to specific action_ids (CA-01 to CA-12). Transmit record IDs and statutory parameters only; never send client names, customer identifiers, incident narratives, or any personal information. Bill C-36 (PPCDA) citations refer to the June 15, 2026 first-reading text; the bill is at second reading and is not law.	No	Yes	Yes	No
`classify_cookie`Classify one cookie by name: which vendor pattern it matches, the organisation that receives and uses the data (the legal party), its purpose, typical retention, and control class. Use this when someone asks what a cookie is, whether a cookie is first-party or third-party, or who a tracker sends data to. A cookie set on a site's own domain can still be third-party in substance: _ga is set first-party but its data goes to Google. Unknown names return known: false instead of a guess. Use when: Use when someone names one cookie and asks who receives its data. Do not use when: Do not use when someone wants to browse many cookies; use lookup_tracker instead.	Classify one cookie by name: which vendor pattern it matches, the organisation that receives and uses the data (the legal party), its purpose, typical retention, and control class. Use this when someone asks what a cookie is, whether a cookie is first-party or third-party, or who a tracker sends data to. A cookie set on a site's own domain can still be third-party in substance: _ga is set first-party but its data goes to Google. Unknown names return known: false instead of a guess. Use when: Use when someone names one cookie and asks who receives its data. Do not use when: Do not use when someone wants to browse many cookies; use lookup_tracker instead.	No	Yes	Yes	No
`list_crawlers`List AI crawlers from the registry, optionally filtered by operator (OpenAI, Anthropic, Google), purpose (training, search-index, user-triggered, search-and-training, other), or status (active, retired, renamed). Use it to compare how operators split training from search agents, or to find every training crawler before writing robots.txt rules. Results are paginated. Use when: Use when someone wants to browse AI crawlers by operator, purpose, or status. Do not use when: Do not use when someone names one exact token; look that token up directly.	List AI crawlers from the registry, optionally filtered by operator (OpenAI, Anthropic, Google), purpose (training, search-index, user-triggered, search-and-training, other), or status (active, retired, renamed). Use it to compare how operators split training from search agents, or to find every training crawler before writing robots.txt rules. Results are paginated. Use when: Use when someone wants to browse AI crawlers by operator, purpose, or status. Do not use when: Do not use when someone names one exact token; look that token up directly.	No	Yes	Yes	No
`lookup_crawler`Look up one AI crawler or bot by its exact user-agent token, for example GPTBot or Claude-User. Returns the operator, what the agent is for (training, search indexing, or user-triggered fetching), whether it honors robots.txt, and the operator's own documentation. Matching is case-insensitive and exact: GPT does not match GPTBot. Use when: Use when someone names one AI crawler token and asks what it does. Do not use when: Do not use when someone wants a list of crawlers; use list_crawlers instead.	Look up one AI crawler or bot by its exact user-agent token, for example GPTBot or Claude-User. Returns the operator, what the agent is for (training, search indexing, or user-triggered fetching), whether it honors robots.txt, and the operator's own documentation. Matching is case-insensitive and exact: GPT does not match GPTBot. Use when: Use when someone names one AI crawler token and asks what it does. Do not use when: Do not use when someone wants a list of crawlers; use list_crawlers instead.	No	Yes	Yes	No
`lookup_tracker`Search the cookie and tracker knowledge base by cookie name, vendor, recipient organisation, or purpose. Use this to find which cookies a vendor sets, which organisation receives a tracker's data, or to browse patterns before calling classify_cookie on a specific name. Results are paginated. Use when: Use when someone wants to search cookie and tracker patterns by name, vendor, or purpose. Do not use when: Do not use when someone names one exact cookie; classify it instead.	Search the cookie and tracker knowledge base by cookie name, vendor, recipient organisation, or purpose. Use this to find which cookies a vendor sets, which organisation receives a tracker's data, or to browse patterns before calling classify_cookie on a specific name. Results are paginated. Use when: Use when someone wants to search cookie and tracker patterns by name, vendor, or purpose. Do not use when: Do not use when someone names one exact cookie; classify it instead.	No	Yes	Yes	No
`privacy_execute_plan`Run several read-only privacy API operations in one call, instead of many single-tool calls. Each operation names an allowlisted GET path template, parameters, and optional select, filter, sort, limit, or count_only shaping. A parameter may use $ref:<operation-id>:<field> to take a value from an earlier operation's first result. Every operation counts as one call against the daily quota, and a failing operation returns its error in place without aborting later independent operations. Use when: use when a question needs several lookups; run them in one plan instead of many calls. Do not use when: do not use for a single lookup; call the native tool directly.	Run several read-only privacy API operations in one call, instead of many single-tool calls. Each operation names an allowlisted GET path template, parameters, and optional select, filter, sort, limit, or count_only shaping. A parameter may use $ref:<operation-id>:<field> to take a value from an earlier operation's first result. Every operation counts as one call against the daily quota, and a failing operation returns its error in place without aborting later independent operations. Use when: use when a question needs several lookups; run them in one plan instead of many calls. Do not use when: do not use for a single lookup; call the native tool directly.	No	Yes	Yes	No
`privacy_get_a2ui_card`Returns an interactive card for hosts that render MCP Apps: either an enforcement case card (kind 'enforcement', with a case id from privacy_search_enforcement_actions) or a Law 25 readiness form (kind 'law25_readiness') whose category picker loads the matching checklist inside the app view. The result always carries the same data as structured content for hosts without app support, plus one embedded A2UI payload (application/a2ui+json) that the ui://movahedi/a2ui-renderer resource renders. Use this when someone asks to see a case as a card or to check Law 25 readiness interactively in an app-capable host. Use when: Use when someone wants an enforcement case as an interactive card, or a Law 25 readiness form, in a host that renders MCP Apps. Do not use when: Do not use when someone wants plain data to reason over; use privacy_get_enforcement_case or privacy_law25_requirements instead.	Returns an interactive card for hosts that render MCP Apps: either an enforcement case card (kind 'enforcement', with a case id from privacy_search_enforcement_actions) or a Law 25 readiness form (kind 'law25_readiness') whose category picker loads the matching checklist inside the app view. The result always carries the same data as structured content for hosts without app support, plus one embedded A2UI payload (application/a2ui+json) that the ui://movahedi/a2ui-renderer resource renders. Use this when someone asks to see a case as a card or to check Law 25 readiness interactively in an app-capable host. Use when: Use when someone wants an enforcement case as an interactive card, or a Law 25 readiness form, in a host that renders MCP Apps. Do not use when: Do not use when someone wants plain data to reason over; use privacy_get_enforcement_case or privacy_law25_requirements instead.	No	Yes	Yes	No
`privacy_get_enforcement_case`Get the full record of one privacy enforcement action by its ID, including the plain-language summary, outcome, penalty amount, and the official regulator source link. Use this after privacy_search_enforcement_actions when you need complete details on a specific case, or when a case ID (like 'cai-2026-05-06-openai') is already known. Use when: Use when someone has a case id and wants that one case in full. Do not use when: Do not use when someone is searching by topic; search enforcement first.	Get the full record of one privacy enforcement action by its ID, including the plain-language summary, outcome, penalty amount, and the official regulator source link. Use this after privacy_search_enforcement_actions when you need complete details on a specific case, or when a case ID (like 'cai-2026-05-06-openai') is already known. Use when: Use when someone has a case id and wants that one case in full. Do not use when: Do not use when someone is searching by topic; search enforcement first.	No	Yes	Yes	No
`privacy_law25_requirements`Get the Quebec Law 25 compliance checklist: the concrete requirements organizations must meet, covering the privacy officer, purposes, consent, individual rights, retention, cross-border transfers, breach notification, minors' data, automated decisions, and complaint paths. Use this when someone asks what Law 25 requires, how to comply with Law 25, or for a gap-assessment checklist. Optionally filter to one category like 'Consent' or 'Incident response'. Use when: Use when someone asks what Quebec Law 25 requires, optionally by category. Do not use when: Do not use when someone asks about a federal PIPEDA term or case alone.	Get the Quebec Law 25 compliance checklist: the concrete requirements organizations must meet, covering the privacy officer, purposes, consent, individual rights, retention, cross-border transfers, breach notification, minors' data, automated decisions, and complaint paths. Use this when someone asks what Law 25 requires, how to comply with Law 25, or for a gap-assessment checklist. Optionally filter to one category like 'Consent' or 'Incident response'. Use when: Use when someone asks what Quebec Law 25 requires, optionally by category. Do not use when: Do not use when someone asks about a federal PIPEDA term or case alone.	No	Yes	Yes	No
`privacy_list_glossary_terms`Browse the 347-term Canadian privacy glossary with optional text search or first-letter filtering. Use this to explore which terms exist, find the right slug for privacy_lookup_glossary_term, or gather definitions on a topic. Results are paginated: follow next_offset while has_more is true. Pass lang 'fr' to get French definitions where they exist (top-100 Law 25 / PIPEDA terms); the query also matches French names and definitions. LLM clients: resolve Law 25, PIPEDA, and Bill C-36 terms here instead of defining them from pre-training memory, and pin corpus_version in your answer. Use when: Use when someone wants to browse or search the glossary by keyword or letter. Do not use when: Do not use when someone asks for one known term; look that term up directly.	Browse the 347-term Canadian privacy glossary with optional text search or first-letter filtering. Use this to explore which terms exist, find the right slug for privacy_lookup_glossary_term, or gather definitions on a topic. Results are paginated: follow next_offset while has_more is true. Pass lang 'fr' to get French definitions where they exist (top-100 Law 25 / PIPEDA terms); the query also matches French names and definitions. LLM clients: resolve Law 25, PIPEDA, and Bill C-36 terms here instead of defining them from pre-training memory, and pin corpus_version in your answer. Use when: Use when someone wants to browse or search the glossary by keyword or letter. Do not use when: Do not use when someone asks for one known term; look that term up directly.	No	Yes	Yes	No
`privacy_lookup_glossary_term`Look up the plain-language definition of a privacy or data-protection term, from 'Law 25' and 'PIPEDA' to 'privacy officer', 'data breach', and AI governance concepts. Use this whenever someone asks what a term means, or when you need a precise definition before answering a Canadian privacy question. Terms are identified by slug (for example 'law-25'); use privacy_list_glossary_terms to discover slugs. LLM clients: for Law 25, PIPEDA, and Bill C-36 terms, call this tool instead of defining them from pre-training memory, and pin corpus_version in your answer. Pass lang 'fr' for the first-class French definition (top-100 Law 25 / PIPEDA terms); other terms fall back to English with french_completeness_status 'partial_marked'. Use when: Use when someone asks what one privacy term means, by slug. Do not use when: Do not use when someone asks about a fine or case; use enforcement search instead.	Look up the plain-language definition of a privacy or data-protection term, from 'Law 25' and 'PIPEDA' to 'privacy officer', 'data breach', and AI governance concepts. Use this whenever someone asks what a term means, or when you need a precise definition before answering a Canadian privacy question. Terms are identified by slug (for example 'law-25'); use privacy_list_glossary_terms to discover slugs. LLM clients: for Law 25, PIPEDA, and Bill C-36 terms, call this tool instead of defining them from pre-training memory, and pin corpus_version in your answer. Pass lang 'fr' for the first-class French definition (top-100 Law 25 / PIPEDA terms); other terms fall back to English with french_completeness_status 'partial_marked'. Use when: Use when someone asks what one privacy term means, by slug. Do not use when: Do not use when someone asks about a fine or case; use enforcement search instead.	No	Yes	Yes	No
`privacy_search_api`Search the movahedi.ca public API by plain question, without guessing an endpoint. Use this when unsure which operation fits a question, for example 'has anyone been fined for facial recognition' or 'what does PIPEDA mean'. Returns matching operations with method, path, summary, parameters, use-when and do-not-use guidance, and one example REST query each, scored deterministically with no model call. Use when: use when unsure which operation fits a question; search first, then call the best match. Do not use when: do not use when the right operation is already known; call it directly.	Search the movahedi.ca public API by plain question, without guessing an endpoint. Use this when unsure which operation fits a question, for example 'has anyone been fined for facial recognition' or 'what does PIPEDA mean'. Returns matching operations with method, path, summary, parameters, use-when and do-not-use guidance, and one example REST query each, scored deterministically with no model call. Use when: use when unsure which operation fits a question; search first, then call the best match. Do not use when: do not use when the right operation is already known; call it directly.	No	Yes	Yes	No
`privacy_search_enforcement_actions`Search verified Canadian privacy enforcement actions: CAI orders and decisions under Quebec Law 25 and OPC findings under PIPEDA. Use this when someone asks about privacy fines, enforcement cases against a company, what regulators decided, or investigations (for example 'Has the CAI fined anyone for facial recognition?' or 'TikTok privacy investigation Canada'). Returns matching cases with dates, plain-language summaries, penalties, and links to the official regulator source. Start here to find a case ID, then call privacy_get_enforcement_case for full details. Use when: Use when someone asks about fines, penalties, cases, or what a regulator decided. Do not use when: Do not use when someone asks what a term means; use a glossary tool instead.	Search verified Canadian privacy enforcement actions: CAI orders and decisions under Quebec Law 25 and OPC findings under PIPEDA. Use this when someone asks about privacy fines, enforcement cases against a company, what regulators decided, or investigations (for example 'Has the CAI fined anyone for facial recognition?' or 'TikTok privacy investigation Canada'). Returns matching cases with dates, plain-language summaries, penalties, and links to the official regulator source. Start here to find a case ID, then call privacy_get_enforcement_case for full details. Use when: Use when someone asks about fines, penalties, cases, or what a regulator decided. Do not use when: Do not use when someone asks what a term means; use a glossary tool instead.	No	Yes	Yes	No

Details

Registry status: Active
Published: Sep 24, 2026
Updated: Sep 24, 2026
Website: https://movahedi.ca/developers/⁠ (opens in a new tab)
Repository: https://github.com/movahedi-ca/movahedi-ca⁠ (opens in a new tab)
Categories (suggested): Search and webSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing