movahedi.ca Privacy Data

Measured conclusion: Alive, not deep-tested. L2 outcome: not_attempted.

Canadian privacy enforcement, glossary, and Quebec Law 25 guidance for AI agents.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "movahedi.ca Privacy Data": {
      "url": "https://movahedi.ca/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (11)

• privacy_search_enforcement_actions read-only

  Search verified Canadian privacy enforcement actions: CAI orders and decisions under Quebec Law 25 and OPC findings under PIPEDA. Use this when someone asks about privacy fines, enforcement cases against a company, what regulators decided, or investigations (for example 'Has the CAI fined anyone for facial recognition?' or 'TikTok privacy investigation Canada'). Returns matching cases with dates, plain-language summaries, penalties, and links to the official regulator source. Start here to find a case ID, then call privacy_get_enforcement_case for full details. Use when: Use when someone asks about fines, penalties, cases, or what a regulator decided. Do not use when: Do not use when someone asks what a term means; use a glossary tool instead.

  Parameters:

  • year — integer — Filter by decision year.
  • limit — integer — Maximum cases to return in this call.
  • query — string — Free-text search over case titles and summaries.
  • offset — integer — Number of matching cases to skip. Use next_offset from the previous response to page forward.
  • regulator — string — Limit to one regulator: 'cai' (Quebec Commission d'acces a l'information, Law 25) or 'opc' (federal Office of the Privacy Commissioner, PIPEDA).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_get_enforcement_case read-only

  Get the full record of one privacy enforcement action by its ID, including the plain-language summary, outcome, penalty amount, and the official regulator source link. Use this after privacy_search_enforcement_actions when you need complete details on a specific case, or when a case ID (like 'cai-2026-05-06-openai') is already known. Use when: Use when someone has a case id and wants that one case in full. Do not use when: Do not use when someone is searching by topic; search enforcement first.

  Parameters:

  • id (required) — string — The case ID from a search result.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_lookup_glossary_term read-only

  Look up the plain-language definition of a privacy or data-protection term, from 'Law 25' and 'PIPEDA' to 'privacy officer', 'data breach', and AI governance concepts. Use this whenever someone asks what a term means, or when you need a precise definition before answering a Canadian privacy question. Terms are identified by slug (for example 'law-25'); use privacy_list_glossary_terms to discover slugs. Use when: Use when someone asks what one privacy term means, by slug. Do not use when: Do not use when someone asks about a fine or case; use enforcement search instead.

  Parameters:

  • term (required) — string — The glossary slug.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_list_glossary_terms read-only

  Browse the 319-term Canadian privacy glossary with optional text search or first-letter filtering. Use this to explore which terms exist, find the right slug for privacy_lookup_glossary_term, or gather definitions on a topic. Results are paginated: follow next_offset while has_more is true. Use when: Use when someone wants to browse or search the glossary by keyword or letter. Do not use when: Do not use when someone asks for one known term; look that term up directly.

  Parameters:

  • limit — integer — Maximum terms to return in this call.
  • query — string — Search term names and definitions.
  • offset — integer — Number of matching terms to skip. Use next_offset to page forward.
  • starts_with — string — Only terms whose slug starts with this letter.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_law25_requirements read-only

  Get the Quebec Law 25 compliance checklist: the concrete requirements organizations must meet, covering the privacy officer, purposes, consent, individual rights, retention, cross-border transfers, breach notification, minors' data, automated decisions, and complaint paths. Use this when someone asks what Law 25 requires, how to comply with Law 25, or for a gap-assessment checklist. Optionally filter to one category like 'Consent' or 'Incident response'. Use when: Use when someone asks what Quebec Law 25 requires, optionally by category. Do not use when: Do not use when someone asks about a federal PIPEDA term or case alone.

  Parameters:

  • category — string — Only requirements in this category. Omit for the full checklist.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• classify_cookie read-only

  Classify one cookie by name: which vendor pattern it matches, the organisation that receives and uses the data (the legal party), its purpose, typical retention, and control class. Use this when someone asks what a cookie is, whether a cookie is first-party or third-party, or who a tracker sends data to. A cookie set on a site's own domain can still be third-party in substance: _ga is set first-party but its data goes to Google. Unknown names return known: false instead of a guess. Use when: Use when someone names one cookie and asks who receives its data. Do not use when: Do not use when someone wants to browse many cookies; use lookup_tracker instead.

  Parameters:

  • name (required) — string — The cookie name only, for example '_ga' or '_fbp'. Not a value, not a URL.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• lookup_tracker read-only

  Search the cookie and tracker knowledge base by cookie name, vendor, recipient organisation, or purpose. Use this to find which cookies a vendor sets, which organisation receives a tracker's data, or to browse patterns before calling classify_cookie on a specific name. Results are paginated. Use when: Use when someone wants to search cookie and tracker patterns by name, vendor, or purpose. Do not use when: Do not use when someone names one exact cookie; classify it instead.

  Parameters:

  • limit — integer — Maximum patterns to return in this call.
  • query — string — Free-text search over pattern, vendor, recipient, and purpose.
  • offset — integer — Number of matching patterns to skip. Use next_offset to page forward.
  • vendor — string — Limit to one vendor, matched as a substring, for example 'Google'.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• lookup_crawler read-only

  Look up one AI crawler or bot by its exact user-agent token, for example GPTBot or Claude-User. Returns the operator, what the agent is for (training, search indexing, or user-triggered fetching), whether it honors robots.txt, and the operator's own documentation. Matching is case-insensitive and exact: GPT does not match GPTBot. Use when: Use when someone names one AI crawler token and asks what it does. Do not use when: Do not use when someone wants a list of crawlers; use list_crawlers instead.

  Parameters:

  • token (required) — string — The exact user-agent token only, for example 'GPTBot' or 'Claude-User'. Not a full user-agent string, not a URL.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• list_crawlers read-only

  List AI crawlers from the registry, optionally filtered by operator (OpenAI, Anthropic, Google), purpose (training, search-index, user-triggered, search-and-training, other), or status (active, retired, renamed). Use it to compare how operators split training from search agents, or to find every training crawler before writing robots.txt rules. Results are paginated. Use when: Use when someone wants to browse AI crawlers by operator, purpose, or status. Do not use when: Do not use when someone names one exact token; look that token up directly.

  Parameters:

  • limit — integer — Maximum records to return in this call.
  • query — string — Free-text search over token, operator, and notes.
  • offset — integer — Number of matching records to skip. Use next_offset to page forward.
  • status — string — Limit to one lifecycle status.
  • purpose — string — Limit to one purpose class.
  • operator — string — Limit to one operator, matched exactly but case-insensitively, for example 'OpenAI'.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_search_api read-only

  Search the movahedi.ca public API by plain question, without guessing an endpoint. Use this when unsure which operation fits a question, for example 'has anyone been fined for facial recognition' or 'what does PIPEDA mean'. Returns matching operations with method, path, summary, parameters, use-when and do-not-use guidance, and one example REST query each, scored deterministically with no model call. Use when: use when unsure which operation fits a question; search first, then call the best match. Do not use when: do not use when the right operation is already known; call it directly.

  Parameters:

  • limit — integer — Maximum operations to return, default 5.
  • query — string — Plain question about privacy data, up to 120 characters.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• privacy_execute_plan read-only

  Run several read-only privacy API operations in one call, instead of many single-tool calls. Each operation names an allowlisted GET path template, parameters, and optional select, filter, sort, limit, or count_only shaping. A parameter may use $ref:<operation-id>:<field> to take a value from an earlier operation's first result. Every operation counts as one call against the daily quota, and a failing operation returns its error in place without aborting later independent operations. Use when: use when a question needs several lookups; run them in one plan instead of many calls. Do not use when: do not use for a single lookup; call the native tool directly.

  Parameters:

  • operations — array — Operations to run in order, at most 10. Each has id, path, params, and optional select, filter, sort, limit, count_only.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.