Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/jonase47/ccpr/p2-regulatory-checkgit clone --depth 1 https://github.com/jonase47/ccprWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/jonase47/ccpr/p2-regulatory-check)<a href="https://agentmods.dev/commands/jonase47/ccpr/p2-regulatory-check"><img src="https://agentmods.dev/badge/commands/jonase47/ccpr/p2-regulatory-check.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01305 |
| Opus 5 | $0.00000 | $0.00652 |
| Sonnet 5 | $0.00000 | $0.00261 |
| Haiku 4.5 | $0.00000 | $0.00130 |
Grade A, and why
p2-regulatory-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/p2-regulatory-check – Validate Regulatory Feasibility
Validates the regulatory Assumptions from Phase 1 concretely and practically: Is the venture legally implementable? Which hurdles are real, which are surmountable? The result is a robust regulatory validation as the Decision basis for Gate 2.
Argument: $ARGUMENTS = [Regulation or area, e.g. "DiGA", "DSGVO Art. 9", "GwG", "MDR"]
If provided: Focus the validation on the named regulation or area. If not provided: Read ASSUMPTIONS.md and DSGVO_INITIAL_ASSESSMENT.md and check all open regulatory Assumptions. If any context is missing, ask for the relevant regulatory areas.
Execution
1. Read Context
Read the following files (if available):
- ASSUMPTIONS.md (regulatory Assumptions with prioritisation)
- DSGVO_INITIAL_ASSESSMENT.md (results from
/p1-privacy) - DISCOVERY.md (regulatory assessment from
/p0-regulatory) - CONCEPT.md / FEATURES.md (What exactly is to be implemented?)
2. Delegate to security-master Agent (Lead)
Delegate the regulatory validation to the security-master agent:
Validate the regulatory Assumptions for the following area: $ARGUMENTS Context from ASSUMPTIONS.md and DSGVO_INITIAL_ASSESSMENT.md: [Insert relevant Assumptions]
Check and evaluate concretely:
A. DSGVO Feasibility
- Are the legal bases identified in DSGVO_INITIAL_ASSESSMENT.md actually applicable?
- Are the planned technical and organisational measures (TOMs) sufficient?
- Is a Data Protection Impact Assessment (DPIA) required and feasible?
- Are data processing agreements (DPA) with all relevant third parties possible?
B. Sector-Specific Regulation (if $ARGUMENTS is specific)
- What are the concrete requirements of this regulation?
- Which certifications or approvals are needed?
- How long do these processes typically take?
- What do they cost (time + money)?
C. Result per Assumption
- ✅ Confirmed: Regulatory implementation feasible
- ⚠️ Feasible with effort: Describe concrete measures and timeline
- ❌ Not feasible / knock-out criterion: Clear rationale and alternatives
D. Recommendations for Action
- What must be adjusted in the Concept or MVP scope?
- What should be legally secured (involve a lawyer)?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +3 lines a4eb63081220
- 5d ago First seen · 108 lines · 0 tokens per session scan A 35411f582c6c
p2-regulatory-check is a command published in the GitHub repository jonase47/ccpr (1 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,305 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
compliance
Generate compliance-as-code policies with automated evidence. Usage - /mindforge:compliance [--framework soc2|hipaa|pci] [--engine opa|sentinel].
mindforge:fintech
Design fintech payment/ledger architecture. Usage: /mindforge:fintech [service] [--domain payments|ledger|kyc] [--compliance pci|sox].
mindforge:healthcare
Design HIPAA-compliant healthcare system architecture. Usage: /mindforge:healthcare [service] [--standard hipaa|hl7|fhir] [--scope full|audit].
voice-compliance
Voice/telephony compliance check — invokes voice-ai-reviewer to produce TM-voice-{slug}.md with TCPA, STIR/SHAKEN, state recording-consent, EU AI Act Art. 50, and synth-voice deepfake-law gaps.
au-pspf
You are an enterprise architect generating a Protective Security Policy Framework (PSPF) compliance assessment for an Australian Government entity or contractor handling government information.
india-checklist
Interactive non-code compliance checklist — business registration, DPO, GST, CERT-In, grievance officer, and more.