Free · No account

A compliance check inside your coding agent.

Building an app? Add Regulane to Claude Code, Cursor, Copilot, Codex, Windsurf or Gemini CLI with one line. Your agent checks your code against 34 secure-coding rules mapped to ISO 27001 and the DPDP Act, and you get a scorecard. Your code never leaves your machine.

Set it up See a scorecard

Free · No account · Regulane never receives your code

Secure-coding rules: 34
Areas, from secrets to infrastructure: 8
To add it to your agent: One line
Stored from a free check: Nothing

01Set it up

One line in the agent you already use.

No token and no sign-up. Run the command, or add the lines to the file shown, then restart the agent if it asks.

Claude Code

Run in a terminal

claude mcp add --transport http regulane https://regulane.com/api/mcp

Cursor

~/.cursor/mcp.json, or .cursor/mcp.json in one project

{
  "mcpServers": {
    "regulane": {
      "url": "https://regulane.com/api/mcp"
    }
  }
}

VS Code (Copilot)

Run in a terminal

code --add-mcp '{"name":"regulane","type":"http","url":"https://regulane.com/api/mcp"}'

Codex

Run in a terminal

codex mcp add regulane --url https://regulane.com/api/mcp

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "regulane": {
      "serverUrl": "https://regulane.com/api/mcp"
    }
  }
}

Gemini CLI

Run in a terminal

gemini mcp add --transport http regulane https://regulane.com/api/mcp

Other agents

Any agent that runs only local (stdio) servers, through the mcp-remote bridge

{
  "mcpServers": {
    "regulane": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://regulane.com/api/mcp"
      ]
    }
  }
}

The address is https://regulane.com/api/mcp, a Model Context Protocol server over HTTP.

02How a check runs

Your agent does the reading. Regulane supplies the rules.

Regulane never runs or receives your code. It tells your agent what to look for, and turns what the agent found into a scorecard.

01Ask your agentYou“Check this app with Regulane.” Clients that support MCP prompts also get a compliance_review command.
02Sends the rulesRegulane34 secure-coding rules, each saying what to look for and how to fix it, mapped to ISO 27001 Annex A and the DPDP Act.
03Reads your code, on your machineYour agentThe agent you already use checks the code it already has open. Regulane never receives the code.
04Reports what it foundYour agentFor each problem: a file path, a line number and one sentence. Anything that looks like a secret or personal data is removed on arrival.
05Returns a scorecardRegulaneFindings by severity, the controls they affect, the fix for each, and what was not checked. A free check is not stored.

03The scorecard

What comes back to your agent.

This is the real output for an example app with three findings. Your agent shows it to you and can offer to make each fix.

Example · report_compliance_check

Regulane compliance check of github.com/example/expense-app (main), ruleset 2026.10
Rules checked: 29 of 34.
Result: 3 findings: 1 critical, 2 high.
Affects ISO 27001 controls A.5.15, A.5.34, A.8.3, A.8.11, A.8.15, A.8.24, A.8.26 and DPDP Act s.8(5).

Findings, most severe first:
- [critical] RG-SC-004 Record fetched without an ownership check — src/api/expenses/[id].ts:18
An expense is loaded by id without checking it belongs to the signed-in user.
Fix: Scope every query by the caller's tenant or owner from the session, for example where: { id, tenantId }, and answer not found for someone else's record.
- [high] RG-SC-018 Personal data in logs, errors or analytics — src/lib/auth.ts:52
Failed sign-ins log the full email address.
Fix: Log ids, not people. Mask or drop personal fields before logging, and scrub them in the error tracker's before-send hook.
- [high] RG-SC-016 Weak or home-made cryptography — src/lib/reset.ts:7
Password reset codes come from Math.random.
Fix: Use the platform's crypto library: AES-256-GCM or ChaCha20-Poly1305 with random nonces, SHA-256 or better, HMAC for integrity, and a CSPRNG (crypto.randomBytes, secrets) for anything secret.

Not checked: Dependencies and build pipeline; Infrastructure and configuration. Check these too for a complete result.

Regulane did not store this report.
To keep each repository's history, track and accept findings, and show them to an auditor as evidence for ISO 27001 and the DPDP Act, create a workspace at https://regulane.com/get-started and connect with an agent token.

04The rules

34 rules, each tied to a control.

Ruleset 2026.10. 7 are critical. Every rule names the ISO 27001:2022 Annex A controls it relates to, and 7 also name sections of the DPDP Act 2023. Your agent receives each rule’s full check and fix.

Secrets, authentication and access control

Secret committed to sourceRG-SC-001 · A.5.17, A.8.24, A.8.28critical
Server secret exposed to the browser or app bundleRG-SC-002 · A.8.12, A.8.28critical
Endpoint without authenticationRG-SC-003 · A.5.15, A.8.5, A.8.26critical
Record fetched without an ownership checkRG-SC-004 · A.5.15, A.8.3, A.8.26critical
Identity, role or outcome taken from the clientRG-SC-005 · A.8.26, A.8.28high
Weak password storageRG-SC-006 · A.5.17, A.8.5, A.8.24critical
Unsafe session or token handlingRG-SC-007 · A.8.5, A.8.24high
No limit on sign-in or costly endpointsRG-SC-008 · A.8.5, A.8.6medium
Security control switched offRG-SC-034 · A.8.28, A.8.32high

Injection and unsafe input handling

SQL or NoSQL injectionRG-SC-009 · A.8.28critical
Command injection or unsafe code executionRG-SC-010 · A.8.28critical
Cross-site scriptingRG-SC-011 · A.8.28high
Unsafe file path or upload handlingRG-SC-012 · A.8.28high
Server-side request forgeryRG-SC-013 · A.8.20, A.8.28high
Open redirectRG-SC-014 · A.8.28medium
State change open to cross-site requestsRG-SC-015 · A.8.26, A.8.28high

Cryptography and transport security

Weak or home-made cryptographyRG-SC-016 · A.8.24high
Transport security disabledRG-SC-017 · A.8.20, A.8.24high

Personal data (DPDP Act)

Personal data in logs, errors or analyticsRG-SC-018 · A.5.34, A.8.11, A.8.15 · DPDP s.8(5)high
Personal data collected without notice or consentRG-SC-019 · A.5.34 · DPDP s.4, s.5, s.6medium
Personal data kept with no way to erase itRG-SC-020 · A.5.34, A.8.10 · DPDP s.8(7), s.12medium
Children's data processed unsafelyRG-SC-021 · A.5.34 · DPDP s.9high
Sensitive identifiers stored or shown unprotectedRG-SC-022 · A.5.34, A.8.11, A.8.24 · DPDP s.8(5)high
Personal data sent to a new third partyRG-SC-023 · A.5.19, A.5.20, A.5.23 · DPDP s.8(2), s.16medium
Personal or confidential data sent to an AI modelRG-SC-024 · A.5.34, A.8.11, A.8.12 · DPDP s.8(5)medium

Logging and error handling

Security event not recordedRG-SC-025 · A.8.15, A.8.16medium
Error response leaks internalsRG-SC-026 · A.8.12, A.8.28medium

Dependencies and build pipeline

Risky dependency addedRG-SC-027 · A.5.21, A.8.8, A.8.19high
Build pipeline can be tampered withRG-SC-028 · A.5.21, A.8.25, A.8.32medium

Infrastructure and configuration

Insecure infrastructure configurationRG-SC-029 · A.5.23, A.8.2, A.8.9, A.8.20high
Permissive CORS or security headers removedRG-SC-030 · A.8.9, A.8.26medium
Production data or credentials outside productionRG-SC-031 · A.8.11, A.8.31, A.8.33medium

Change safety and testing

Destructive data change without a safeguardRG-SC-032 · A.5.33, A.8.13, A.8.32medium
Security change without a test of the deny pathRG-SC-033 · A.8.29low

05Your code stays with you

What Regulane receives, and what it never does.

What your agent sends

The repository name or address (any credentials in it are removed), branch and commit
Which agent ran the check, and one line on what it looked at
The rule ids it checked
For each finding: a file path, a line number and one sentence

What Regulane never receives or keeps

Your source code, diffs or file contents
Secrets: anything that looks like a key, token or password is replaced before the report is read
Personal data: email addresses, card, Aadhaar and PAN numbers are replaced the same way
Any record of a free check: the scorecard goes back to your agent and is not stored

What a free check is not

Regulane does not run your code or scan it itself. Your coding agent does the checking, so the result is only as careful as the agent and the scope you give it.
A clean scorecard is not a certification, an audit opinion or a penetration test.
The rules cover secure coding and personal-data handling in code. They do not cover your policies, people, suppliers or physical security, which an ISO 27001 audit also looks at.
A free check keeps no history. To track findings over time, accept them with a reason and show them to an auditor, connect a Regulane workspace.

06For a team

Keep every check as evidence.

Connect a Regulane workspace with a token per developer, and each repository’s checks and findings are kept for your team and your auditor.

Start free trial

14-day trial · No card required

What you get	Free check	Workspace
All 34 rules	Yes	Yes
Scorecard in your agent	Yes	Yes
Account needed	No	Yes
History of every check, per repository	No	Yes
Open findings your agent can come back to	No	Yes
Accept a finding with a reason, in the audit trail	No	Yes
A token per developer, revoked when they leave	No	Yes

07Make it automatic

Checked on every change, without asking.

Add this to your repository’s AGENTS.md (read by Codex, Cursor, Copilot, Windsurf and Gemini CLI) or CLAUDE.md (Claude Code).

AGENTS.md

At the root of your repository

## Compliance checks

This repository is checked with Regulane. Before finishing a change that touches
authentication, access control, personal data, cryptography, logging,
dependencies, CI or infrastructure, use the `regulane` MCP server: call
get_compliance_rules, check the change against those rules, and record the
result with report_compliance_check. Never include source code, secrets or
personal data in a report.

Questions

About the free check

Is the check really free?

Yes. Connect without a token and the rules and the scorecard cost nothing and need no account. Keeping the history of checks in a Regulane workspace is part of the Intelligence plan, and a trial includes it.

Does Regulane see my code?

No. Your coding agent reads the code on your machine, under your agreement with the agent’s provider. Regulane sends it the rules and receives only what it reports: file paths, line numbers and one-sentence findings. Anything in those that looks like a secret or personal data is replaced on arrival.

Which coding agents does it work with?

Any agent that supports the Model Context Protocol over HTTP: Claude Code, Cursor, VS Code with GitHub Copilot, Codex, Windsurf and Gemini CLI, each with the setup shown on this page. Agents that only run local servers can use the mcp-remote bridge.

What do the rules cover?

34 rules in 8 areas: secrets and access control, injection, cryptography, personal data, logging, dependencies and build pipelines, infrastructure configuration, and change safety. Each names the ISO 27001:2022 Annex A controls it relates to, and 7 also name sections of the DPDP Act 2023.

Is a clean scorecard a certification?

No. It says your agent checked the code it was given against these rules and found nothing. It is not an audit opinion or a penetration test, and Regulane does not run or scan your code itself.

Can my team keep the results as audit evidence?

Yes, in a Regulane workspace. A company administrator or manager creates an agent token per developer, and every check is kept per repository with its findings, which managers can accept with a reason. They are shown as agent-reported and do not count toward ISO readiness.

Regulation changes every week. Your compliance programme should know what changed, and what to do next.

Start free trial Explore the demo

14-day trial · No card required · Per workspace, never per seat

A compliance check inside your coding agent.

One line in the agent you already use.

Your agent does the reading. Regulane supplies the rules.

What comes back to your agent.

34 rules, each tied to a control.

Secrets, authentication and access control

Injection and unsafe input handling

Cryptography and transport security

Personal data (DPDP Act)

Logging and error handling

Dependencies and build pipeline

Infrastructure and configuration

Change safety and testing

What Regulane receives, and what it never does.

What your agent sends

What Regulane never receives or keeps

What a free check is not

Keep every check as evidence.

Checked on every change, without asking.

About the free check

Keep reading

Regulation changes every week. Your compliance programme should know what changed, and what to do next.