legal-audit

/legal-audit — German DSGVO Legal Compliance

German-jurisdiction legal compliance for websites and apps. Covers DSGVO, TDDDG, BDSG, DDG, and relevant German case law. Grounds all findings in actual statute via the rechtsinformationen-bund-de MCP when available (see README for setup).

Default jurisdiction: Germany. Supervisory authority defaults to the authority of your Bundesland — see references/law-reference.md for a complete list. Also covers Austria (DSG) and Switzerland (nDSG) where noted.

---

Step 0 — Route

Parse the invocation args or user intent:

Pattern	Mode
audit <path> or a file/dir path given	→ Code Audit
scan <url> or arg starts with http	→ URL Scan
flow <path>	→ Data Flow Review
draft <type>	→ Document Draft
No args or natural-language legal question	→ Full Suite (Audit + Scan + Flow → Draft offer)

Check MCP availability: attempt semantische_rechtssuche with query DSGVO Artikel 6. If it responds, use it for every law lookup. If unavailable, fall back to built-in knowledge — note which source was used in each finding.

Display:

legal-audit | Mode: [X] | Target: [Y] | Law source: [MCP / built-in knowledge]

---

Mode A — Code Audit

Scan the codebase for data collection points and classify each finding by severity.

A1 — Discover

Run these grep patterns (load references/audit-patterns.md for the full list):

# Third-party fetches
grep -r "fetch(\|axios\.\|import.*resend\|import.*nodemailer\|gtag(\|posthog\|supabase\|stripe\|loadStripe" --include="*.ts" --include="*.tsx" --include="*.js" .

# Storage writes
grep -r "document\.cookie\|localStorage\.setItem\|sessionStorage\.setItem\|setCookie\|set-cookie" --include="*.ts" --include="*.tsx" .

# PII field names
grep -rEi "email|phone|iban|firstName|lastName|birthDate|passport|ipAddress" --include="*.ts" --include="*.tsx" .

# Consent gating
grep -r "consent\|cookie_consent\|analytics_storage\|posthog\.init\|opt_out" --include="*.ts" --include="*.tsx" .