--- title: "How to make Claude Desktop Law 25-compliant with MCP" description: "Wire Claude Desktop to an MCP authority layer: ALLOW, DENY, APPROVE, ESCALATE decisions with signed evidence, before the agent touches personal information." url: https://structureclerk.ca/blog/en/claude-desktop-law-25-mcp language: en translation: https://structureclerk.ca/blog/fr/claude-desktop-loi-25-mcp published: 2026-08-19 updated: 2026-08-19 reading_minutes: 9 author: Michel Fotsing, CISSP publisher: StructureClerk — the authority layer for AI agents keywords: Claude Desktop Law 25, MCP compliance, Quebec Law 25 AI, AI agent governance, MCP connector compliance, automated decision article 12.1, cross-border transfer Quebec, signed evidence AI agent --- # How to make Claude Desktop Law 25-compliant with MCP *An agent handling personal information in Quebec must be able to say, before it acts, what it is allowed to do — and prove it afterwards. MCP makes that pluggable in ten minutes.* Your team uses Claude Desktop. Sooner or later someone connects it to the CRM, the client file, the inbox. From that minute on, software is handling the personal information of Quebec residents, and the question stops being “does it work?” and becomes “are we allowed?”. > **What this article does not claim** — Software is never “compliant”. An **organisation** is, or is not. No connector, ours included, makes Claude Desktop compliant with Law 25. What a connector can do is make the rule **executable at decision time** and **provable afterwards**. This is a technical piece, not legal advice — validate your use cases with counsel. ## The problem is not Claude Desktop, it is the moment of decision Internal policy lives in PDFs. Agents decide in milliseconds, inside a tool loop, without reading the PDF. Between the written policy and the executed action there is usually no checkpoint at all. That gap is the whole problem. Law 25 says nothing about AI agents. It talks about collection, communication, automated decisions, and transfers outside Quebec — precisely the things an agent does on its own, fast, thousands of times a day. An agent does not invent a new obligation; it **industrialises** the ones you already have. ## What Law 25 actually demands of an agent reading your data Four provisions of Quebec's private-sector privacy act, as amended by Law 25, fire almost every time an agent is pointed at customer data. *The four provisions an agent deployment almost always triggers.* | Provision | Obligation | What it means for an agent | | --- | --- | --- | | s. 3.1 | Appoint a person in charge of the protection of personal information | Someone must be able to answer for what the agent did — which requires a human-readable trail | | s. 3.3 | Keep a register of confidentiality incidents and notify the CAI where there is a risk of serious injury | An agent that leaks or exposes data creates an incident: you need **what**, **when**, **which data** | | s. 12.1 | Inform the individual of a decision based exclusively on automated processing, and let them submit observations to a person | Any “exclusively automated” decision must be identifiable as such — or reserved for a human | | s. 17 | Conduct a privacy impact assessment before communicating information outside Quebec | The destination is part of the decision, not a detail of your infrastructure | The penalties are not symbolic: administrative monetary penalties up to CA$10M or 2% of worldwide turnover, penal fines up to CA$25M or 4%. And the classic aggravating factor, in every jurisdiction, is not the technical failure — it is the inability to demonstrate that a control existed. ## Why a line in the system prompt is not a control The reflex is to write it into the prompt: “never use personal data without authorisation”. That is useful, and it is not a control. Three reasons, worst first. - **It is not deterministic.** The same prompt, twice, can produce two behaviours. A rule that depends on sampling is not a rule, it is a tendency. - **It is not provable.** Six months later, facing a regulator or a customer, you cannot demonstrate that at 2:32 pm on 3 March the instruction was present, applied, and applied that way. - **It is not reviewable.** A policy buried in a prompt cannot be read, tested, or versioned independently of the rest of the prompt. A control is a decision taken **outside the model**, by a deterministic component, that returns the same answer to the same question every time, and leaves evidence a third party can check without trusting you. > StructureClerk decides; your infrastructure enforces. > — The product thesis, in one line ## The architecture in one picture *The decision is advisory. Enforcement stays with you — which is what makes the layer installable without touching your infrastructure.* ```text Claude Desktop │ (1) the agent wants to act: read a client file, send, pay… ▼ MCP tool authority_decide │ (2) action + jurisdiction + sector ▼ Authority engine (deterministic, no LLM) │ (3) ALLOW · APPROVE · DENY · ESCALATE │ + cited frameworks + Ed25519-signed evidence ▼ Your application (4) enforces: execute, queue for human approval, or refuse ``` That separation is the contract, not a technical shortfall. A third party that **enforces** your rules becomes a failure point in your production path and a custodian of your data. A third party that **decides** only ever sees a description of an action, and its opinion can be logged, overridden, or challenged. ## Setting it up, step by step ### 1. Add the connector in Claude Desktop Settings → Connectors → Add custom connector. Name: StructureClerk. URL: the MCP endpoint below. The server is remote and public: nothing to install, nothing to expose on your network. No key is needed to start — a daily free allowance applies per IP address. ```bash https://structureclerk.ca/api/mcp-http ``` ### 2. Check the tools are actually visible Ask Claude to list the connector's tools. You should see `authority_decide` — the only one that matters for Law 25; the others (mapping, roadmap, assessment) are analysis tools. ```bash curl -s https://structureclerk.ca/api/mcp-http \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' ``` ### 3. Ask a real question, not a demo question Take the most ordinary action your team performs and run it through the tool: “Decide whether an agent may read a customer record in Quebec and send it to a service hosted in the United States.” A demo question gets you a demo answer. ### 4. Wire the decision into the code that acts This is the step nobody skips without paying for it. Until the decision is read by the code that performs the action, you have an opinion, not a control. In practice: call the API before the side effect, and treat `APPROVE` as a human queue, not as a chatty `ALLOW`. ```bash curl -s https://structureclerk.ca/api/v1/authority/decide \ -H 'Content-Type: application/json' \ -d '{ "agent": { "id": "crm-assistant", "autonomy_level": 3 }, "action": { "type": "read.customer_record", "data_categories": ["personal"], "destination_jurisdiction": "US_FED" }, "context": { "jurisdictions": ["CA_QC"], "sector": "tech" } }' ``` ### 5. Keep the evidence, and verify one today Every decision carries an evidence id. Verify one by hand today — not on the day someone asks for it. Verification is free and requires no account: a published promise, locked by a test in the repository. ```bash curl -s https://structureclerk.ca/api/v1/authority/verify/ ``` ## What a decision returns Here is the real response to the step-3 question — a Quebec agent trying to send a customer record to the United States. Reproduced as returned, fields trimmed for readability. ```json { "decision": "APPROVE", "zone": 2, "reason": "cross_border_transfer_mechanism_required", "confidence": 0.95, "matched_rules": [ { "id": "zone2.cross_border_transfer", "specificity": "exact", "confidence": 0.95 } ], "frameworks": [ { "name": "Loi 25", "domain": "data_protection", "jurisdiction": "CA_QC", "last_verified": "2025-01-31", "coverage_tier": "priority" } ], "sources_verified_from": "2025-01-31", "rules_version": "2026-08-14.3", "advisory": true, "evidence": { "id": "ev_...", "sha256": "9f2c...", "signature": "MEUCIQD...", "key_id": "sc-authority-2026" } } ``` - `decision` — one of the four primitives. `APPROVE` means allowed **with** prior human approval, not “allowed with a warning”. - `reason` — a stable code, not a sentence. Here: the transfer requires a mechanism, which maps straight onto the s. 17 assessment. - `confidence` and `matched_rules` — which rule decided, and how specifically. Below 0.90 the engine deliberately falls back to `ESCALATE` rather than guess. - `frameworks` — the frameworks cited, at framework level and never at section level: citing “section 17” as though it were legal advice would be a promise the engine cannot keep. - `sources_verified_from` — the verification date of the oldest source behind this decision. Published, not hidden. - `evidence` — SHA-256 digest of the decision and its Ed25519 signature. ### The case that actually matters: leaving Quebec Change one thing in the request — the destination — and the decision changes. Test that behaviour first, because it is the one written policies miss most often: the same action is fine towards a Montreal server and requires a prior assessment towards an American one. *Four real engine calls, CA_QC context. The reasons are the codes the API returns.* | Action | Destination | Decision | Reason | | --- | --- | --- | --- | | `read.contract` | internal | `ALLOW` | `low_risk_operation` | | `read.customer_record` (personal) | `US_FED` | `APPROVE` | `cross_border_transfer_mechanism_required` | | `hiring.decide` | — | `DENY` | `human_only_decision` | | `payment.execute` CA$12,000 | — | `APPROVE` | `financial_threshold_exceeded` | Note the third one: a hiring decision is denied, not escalated. Section 12.1 governs exclusively automated decisions; the engine reserves them for a human rather than inventing a notification procedure it does not control. A refusal costs nothing, incidentally — scope and balance are checked **before** any billable work. ## Evidence: what you show six months later A decision that exists only in your own logs proves nothing: you are both the author and the witness. That is why every decision ships with evidence whose verification does not depend on us. - **Digest** — SHA-256 over a canonical serialisation of the decision. Absent keys stay absent from the hash, which is what keeps digests stable over time. - **Signature** — Ed25519, public key published at `/.well-known/structureclerk-authority.json`. - **Chaining** — every piece of evidence carries its position in an append-only log; removing a decision breaks the chain. - **Third-party anchoring** — the chain head is timestamped by an external RFC 3161 authority. “Timestamped” evidence and “published” (self-attested) evidence are never presented as the same thing. - **Free verification, no account** — because evidence you must pay to check is not evidence. ## The limits, stated plainly - **It is advisory.** The engine blocks nothing. If your code ignores a `DENY`, the action happens. The evidence will record that it happened against a refusal — better than nothing, worse than a block. - **Citations are framework-level.** “Law 25”, not “section 17, second paragraph”. Section-by-section citation would impersonate legal advice. - **Not all jurisdictions are equal.** The ones the engine decides on are re-verified every cycle; the rest are indicative, and every citation carries its own date. - **Permanently out of scope**: SSO, RBAC, runtime enforcement. Not a backlog item — the thesis. ## Checklist before pointing an agent at Quebec data 1. List the actions the agent can actually trigger (not the ones you wish it would). 2. For each: which data categories, which destination, reversible or not. 3. Flag the ones that produce a decision within the meaning of s. 12.1 — and reserve those for a human. 4. Route the rest through `authority_decide` **before** the side effect. 5. Treat `APPROVE` as a human queue, with a deadline and a named owner. 6. Store the evidence id alongside your application log. 7. Document the privacy impact assessment for any destination outside Quebec, once, and reference it. 8. Verify one piece of evidence by hand, today. If you do not know where to start, the [free compliance assessment](/scan) walks these questions and produces a policy profile — which the API then applies to every decision your organisation makes. It is the on-ramp, and it asks for no credit card. **Does this connector make Claude Desktop compliant with Law 25?** No, and no product can. Compliance is a property of the organisation, not of software. The connector makes the rule executable at the moment the agent acts, and verifiable afterwards; the rest — incident register, appointed privacy officer, impact assessments, informing individuals — remains yours. **Does my data go through StructureClerk?** No. The tool receives a description of an action — action type, data categories, jurisdiction, sector, destination — never the content of the customer record. An authority layer that demanded your data in order to say whether you may process it would be a contradiction. **What happens if the API is unavailable?** Your agent keeps running: the decision is advisory and is not on your infrastructure's critical path. You choose the default posture when it is unreachable — for sensitive actions, defaulting to refuse is the prudent behaviour. **Why is a hiring decision denied rather than approved with oversight?** Because s. 12.1 governs decisions based exclusively on automated processing, with a duty to inform and a right to submit observations. The engine classifies those actions in zone 3 — reserved for humans — instead of pretending to orchestrate a notification procedure it does not control. **Do I need an account to try it?** No. A daily per-IP free allowance lets you try without signing up, and evidence verification is free permanently. Beyond that, an API key spends prepaid credits or the allowance included in an Authority plan. **Does it work with anything other than Claude Desktop?** Yes. The same engine is exposed over REST, A2A and MCP. Any MCP client — Claude Desktop, Cursor, your own agent — talks to the same endpoint, and a service that is not an agent can call the REST API directly. For the decision contract, the four primitives and the evidence format: [the Authority page](/authority). For the organisational on-ramp: [the free assessment](/scan).