klaws — Korean compliance risk scanner

klaws

한국어

Korean law compliance risk scanner for codebases. Scans source code for patterns that may indicate compliance risks under Korean law and maps findings to specific legal provisions. Runs as an MCP server (so AI coding assistants can scan on request) and as a standalone CLI.

Currently covers PIPA (Personal Information Protection Act), the Network Act (정보통신망법), the Credit Information Act (신용정보법), and the E-Commerce Act (전자상거래법).

Disclaimer: klaws identifies possible compliance risks for review. It does not constitute legal advice. Consult qualified legal counsel for definitive guidance.

Privacy: klaws analyzes code locally and transmits nothing. The only outbound network call is the optional --live law lookup to law.go.kr; without that flag it is fully offline. See Privacy & Security.

Quick Start

# Scan the current directory with Docker — no install needed

docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

...or, if you installed the binary:

klaws scan ./my-project # scan a directory klaws scan ./MyService.java # scan a single file

Installation

Docker (recommended)

No toolchain required — the image is published to GitHub Container Registry and works identically on macOS, Linux, and Windows:

# Scan the current directory (mount it read-only at /src)

docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws scan /src

Pin a version instead of the floating latest tag

docker run --rm -v "$PWD":/src:ro ghcr.io/rostradamus/klaws:0.1.6 scan /src

Prebuilt binary

Download the archive for your platform from the latest release, extract it, and move klaws onto your PATH.

go install

go install github.com/rostradamus/klaws/cmd/klaws@latest

From source

Requirements: Go 1.23+

git clone https://github.com/rostradamus/klaws.git

cd klaws go build -o klaws ./cmd/klaws/

Verify the install:

klaws --version

Usage

Scan

# Scan a directory (default: *.java files)

klaws scan ./src

Scan specific file types

klaws scan ./src --pattern "*.kt"

Text output (default is JSON)

klaws scan ./src --format text

SARIF output (for GitHub code scanning / other tools)

klaws scan ./src --format sarif > klaws.sarif

Fail the command (exit 1) if any finding is at or above a severity

klaws scan ./src --fail-on HIGH

Use a custom laws file

klaws scan ./src --laws ./my-laws.yaml

Example Output

klaws scan report

Target: ./testdata Files: 4 Findings: 7

--- Finding 1 --- Detector: PIPA-CST-001 Risk: HIGH Location: testdata/MemberController.java:10 Snippet: @PostMapping("/register") Message: Endpoint accepts possible personal data without apparent consent mechanism — may require review under PIPA Article 15 Laws: PIPA-15

--- Finding 2 --- Detector: PIPA-ENC-001 Risk: HIGH Location: testdata/MemberEntity.java:11 Snippet: private String residentNumber; Message: Possible unencrypted personal identifier (residentNumber) — may require review under PIPA Article 24-2 Laws: PIPA-24-2, PIPA-29

--- Finding 3 --- Detector: PIPA-LOG-001 Risk: MEDIUM Location: testdata/UserService.java:11 Snippet: log.info("User registered: " + email); Message: Possible personal data (email) in log output — may require review under PIPA Article 29 Laws: PIPA-29

Look Up Law Provisions

# Look up from bundled database

klaws law PIPA-15

Fetch live text from law.go.kr

klaws law PIPA-15 --live

List Detectors

klaws detectors

[

{ "id": "PIPA-LOG-001", "name": "Personal Data Logging Risk", "description": "Detects log statements that may contain personal data fields", "related_laws": ["PIPA-29"] }, { "id": "PIPA-ENC-001", "name": "Unencrypted Personal Data Risk", "description": "Detects personal identifier fields stored without apparent encryption", "related_laws": ["PIPA-24-2", "PIPA-29"] }, { "id": "PIPA-CST-001", "name": "Missing Consent Check Risk", "description": "Detects endpoints accepting personal data without apparent consent verification", "related_laws": ["PIPA-15"] } ]

Detectors

Detectors use regex-based pattern matching. They support both English and Korean field names (e.g., email/이메일, residentNumber/주민번호, consent/동의).

MCP Server

klaws can run as an MCP server, making its scanning capabilities available to AI coding assistants.

klaws serve

Available Tools

Configuration

All clients use the same launch command: klaws serve over stdio. Use the absolute path to the binary (run which klaws, or where klaws on Windows, to find it), or just klaws if it is on your PATH. Prefer not to install anything? Use the Docker variant below — it works in any client that supports stdio MCP servers.

Claude Code — ~/.claude/settings.json:

{

"mcpServers": { "klaws": { "command": "klaws", "args": ["serve"] } } }

Or add it in one command:

claude mcp add klaws -- klaws serve

Claude Desktop — claude_desktop_config.json (Settings → Developer → Edit Config):

{

"mcpServers": { "klaws": { "command": "klaws", "args": ["serve"] } } }

Cursor — ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{

"mcpServers": { "klaws": { "command": "klaws", "args": ["serve"] } } }

VS Code — .vscode/mcp.json:

{

"servers": { "klaws": { "command": "klaws", "args": ["serve"] } } }

Once connected, ask your assistant something like *"scan this directory for Korean compliance risks with klaws."*

Run the MCP server via Docker

No binary install needed — swap the command/args for a docker run that mounts the code you want scannable. The -i flag keeps stdin open for the stdio transport; --scan-root /src confines scans to the mounted directory:

{

"mcpServers": { "klaws": { "command": "docker", "args": [ "run", "--rm", "-i", "-v", "/absolute/path/to/your/project:/src:ro", "ghcr.io/rostradamus/klaws:latest", "serve", "--scan-root", "/src" ] } } }

Point the assistant at paths under /src (the container-side mount), e.g. *"scan /src for Korean compliance risks."*

Remote (Streamable HTTP)

By default klaws serve uses stdio (local). To run it as a remote MCP server over HTTP, pass --http:

klaws serve --http :8080

or via the published container image:

docker run --rm -p 8080:8080 ghcr.io/rostradamus/klaws serve --http :8080

The MCP endpoint is then available at http:// :8080/mcp (Streamable HTTP transport). Point an HTTP-capable MCP client at that URL.

Securing a remote server

klaws serve --http :8080 \

--auth-token "$(openssl rand -hex 32)" \ --scan-root /workspace

• --auth-token — requires Authorization: Bearer on every HTTP request; unauthenticated requests get 401. Can also be supplied via the KLAWS_AUTH_TOKEN environment variable. Applies to --http only.
• --scan-root — restricts scan_directory / scan_file to paths within ; requests for paths outside it are rejected. (Also honored in stdio mode.)

Notes:

- --auth-token provides bearer auth but not TLS. For untrusted networks, still terminate TLS at a reverse proxy / gateway in front of klaws.

- The scan_directory and scan_file tools read the server's filesystem (the paths you pass resolve on the host running klaws). For remote scanning, run klaws where the code lives (e.g. a CI runner with the repo checked out) and set --scan-root to that checkout. The get_law_reference and list_detectors tools have no filesystem dependency.

Bundled Law Provisions

klaws ships with 40 articles across 4 Korean laws embedded in the binary (no external files needed):

PIPA (개인정보 보호법) — 10 articles

Network Act (정보통신망법) — 11 articles

| NIA-24-2 | Art