Canadian privacy data, as an API and MCP server.

Quickstart

No key needed for the first 2,000 calls a day. Try it:

curl "https://movahedi.ca/api/v1/enforcement?regulator=cai&per_page=5"

The response is wrapped in a small envelope: data holds the payload, meta holds pagination, lang is always "en".

Endpoints

Every response carries ETag for caching. Send If-None-Match to get a 304 when nothing changed.

Quotas

• Anonymous: 2,000 calls per IP per UTC day.
• With a free key: 10,000 calls per key per UTC day.

Quota headers come back on every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. When the quota is spent you get HTTP 429 with a Retry-After header and a link to get a key.

Authentication

Keys are free and need no account or email. Pass yours as a bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://movahedi.ca/api/v1/glossary?query=consent"

Get a key by solving a Cloudflare Turnstile challenge and accepting the API terms. The key is shown once and never stored on our side.

Examples

JavaScript

const res = await fetch(
  "https://movahedi.ca/api/v1/law25/checklist?category=Consent",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } }
);
const { data } = await res.json();
console.log(data.items.map((c) => c.title));

Python

import requests

res = requests.get(
    "https://movahedi.ca/api/v1/enforcement",
    params={"regulator": "cai", "per_page": 5},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
res.raise_for_status()
for case in res.json()["data"]["items"]:
    print(case["date"], "-", case["title"])

MCP server

Point any MCP client at the Streamable HTTP endpoint: https://movahedi.ca/mcp. No signup, no key needed.

Claude Code

claude mcp add --transport http movahedi-privacy https://movahedi.ca/mcp

Claude Desktop

Open Settings > Connectors > Add custom connector, or use the button above. Enter name Movahedi Privacy API and URL https://movahedi.ca/mcp. On older builds without custom connectors, add this to claude_desktop_config.json instead (requires Node.js):

{
  "mcpServers": {
    "movahedi-ca-privacy": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://movahedi.ca/mcp"]
    }
  }
}

Cursor

Add to ~/.cursor/mcp.json (every project) or .cursor/mcp.json (this project), or use the one-click button above:

{
  "mcpServers": {
    "movahedi-ca-privacy": {
      "url": "https://movahedi.ca/mcp"
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "movahedi-ca-privacy": {
      "serverUrl": "https://movahedi.ca/mcp"
    }
  }
}

VS Code

Add to .vscode/mcp.json:

{
  "servers": {
    "movahedi-ca-privacy": {
      "type": "http",
      "url": "https://movahedi.ca/mcp"
    }
  }
}

Any other client

{
  "mcpServers": {
    "movahedi-ca-privacy": {
      "url": "https://movahedi.ca/mcp"
    }
  }
}

Five read-only tools are exposed:

• privacy_search_enforcement_actions: find cases by keyword, regulator, or year
• privacy_get_enforcement_case: full record for one case ID
• privacy_lookup_glossary_term: definition for one term slug
• privacy_list_glossary_terms: browse or search the glossary, paginated
• privacy_law25_requirements: the Law 25 checklist, optionally by category

Example prompts once connected:

• “Search CAI enforcement actions involving video surveillance and summarize the outcomes.”
• “What is the privacy glossary definition of meaningful consent?”
• “List the Law 25 requirements on consent and data retention.”

Send the API key as Authorization: Bearer ... if you have one. The server negotiates the MCP protocol version on initialize and returns structured output on every tool call.

Listings

Also listed in the Claude Market MCP directory and on Glama.

Error codes

Changelog

v1.0.0, 2026-09-24

• Initial release: enforcement actions, glossary, Law 25 checklist, MCP server, free API keys.
• Data version 2026-09-24: 5 verified enforcement actions, 263 glossary terms, 11 Law 25 checks.

Terms

The data is free for personal and commercial use with attribution to movahedi.ca. It is provided as-is, for information only, and is not legal advice. Full terms: /api/v1/terms.