What Does This Skill Do?
/pg-comply is a multi-tool workflow for GDPR compliance assessments. It chains three specialized audit tools and produces a structured compliance report with a score from 0 to 100. Especially in regulated industries like healthcare or finance, this skill replaces manual audit checklists with automated, reproducible checks.
Workflow Phases
- Phase 1 — PII Scan:
pg_gdpr_auditidentifies columns containing personal data (names, emails, phone numbers, dates of birth) - Phase 2 — Retention Check:
pg_retention_checkfinds records that have exceeded their retention period - Phase 3 — Access Log Analysis:
pg_access_log_reviewchecks access patterns for anomalies (bulk queries, unusual hours) - Phase 4 — Compliance Score: Results are weighted and an overall score is computed
How Is It Called?
Connecting First
Every skill starts with a database connection. The enterprise platform supports multiple profiles — ideal for multi-cluster setups:
▶ Calling tools...
→ pg_connect { "profile": "production-db" }
{
"status": "connected",
"database": "mcp_test",
"version": "PostgreSQL 16.x",
"host": "db.example.com"
}
Claude CLI (Natural Language)
▶ Calling tools...
→ Phase 1/4: pg_gdpr_audit {}
PII found in 3 tables:
→ healthcare.patients: first_name, last_name, email, date_of_birth, phone
→ app.users: email, full_name
→ audit.events: user_email (in JSON field)
Unencrypted: 5 columns in healthcare.patients
→ Phase 2/4: pg_retention_check {}
Retention policy: 365 days for healthcare.patients
→ 847 records exceed retention period
→ Oldest record: 2023-11-14 (over 2 years old)
→ Phase 3/4: pg_access_log_review {}
1,247 accesses analyzed over the last 30 days
→ 2 anomalies detected:
1. Bulk query: SELECT * FROM healthcare.patients (423 rows, 03:42 UTC)
2. Off-hours access by db_analyst
→ Phase 4/4: Compliance Score
╔══════════════════════════════════════════╗
║ Compliance Score: 58 / 100 ║
╠══════════════════════════════════════════╣
║ PII Columns : 8 found ║
║ Unencrypted : 5 columns ║
║ Expired Records : 847 records ║
║ Access Anomalies : 2 detected ║
║ Verdict : ACTION REQUIRED ║
╚══════════════════════════════════════════╝
MCP Protocol (Skill Definition)
const result = await client.callTool("/pg-comply", {});
// Response:
{
"skill": "/pg-comply",
"tools": [
"pg_gdpr_audit",
"pg_retention_check",
"pg_access_log_review"
],
"phases": 4,
"output": {
"score": 58,
"pii_columns": 8,
"unencrypted_pii": 5,
"expired_records": 847,
"access_anomalies": 2,
"verdict": "ACTION_REQUIRED",
"recommendations": [
"Encrypt PII columns in healthcare.patients (AES-256-GCM)",
"Purge 847 records exceeding 365-day retention",
"Review db_analyst off-hours access pattern"
]
}
}
What Happens Under the Hood?
The skill processes three phases sequentially. Each phase builds on the results of the previous one:
Phase 1: GDPR Audit
Scans all tables for columns whose names suggest PII: email, name, phone, birth, address, ssn. Additionally checks whether these columns are encrypted (data type bytea or known encryption wrappers).
Phase 2: Retention Check
Compares timestamp columns (created_at, updated_at) against configured retention periods. Reports the count of expired records and the oldest entry.
Phase 3: Access Log Review
Analyzes pg_stat_activity and custom audit logs for anomalies: bulk queries (>100 rows on PII tables), off-hours access, and unusual roles.
Phase 4: Scoring
Weighted formula for the compliance score:
- 40% — PII Protection (encryption, masking)
- 35% — Retention Compliance (no expired records)
- 25% — Access Control (no anomalies)
Pro Tip: Run /pg-comply monthly and archive the scores. During a GDPR audit, the score history serves as evidence of continuous compliance monitoring.
What Does the Test Suite Validate?
The test suite validates the workflow against a database with healthcare patient data and deliberately placed compliance violations:
✓ /pg-comply > pg_gdpr_audit detects PII in healthcare.patients
✓ /pg-comply > pg_retention_check finds expired records beyond 365 days
Test Files 1 passed (1)
Tests 3 passed (3)
Duration 2.1s
Test Data Scenario
The seed database contains:
- healthcare.patients — 500 rows with first_name, last_name, email, date_of_birth, phone (unencrypted)
- audit.events — 1,247 access logs with user_email, query_text, timestamp, row_count
- Retention policy — 365 days for healthcare.patients, 90 days for audit.events
- Anomaly scenario — A
db_analystaccess at 03:42 UTC on the full patient table
Summary
/pg-comply makes GDPR compliance auditable, reproducible, and documentable. The skill replaces manual audit checklists with automated scans — delivering not just problems, but concrete recommendations for remediation.