KeelenScans — Legal
Know your legal exposure before someone else does.
Keelen's Legal scan is an automated engineering review that reads your repository and maps what the code actually does — what it collects, stores, sends, and shows — to commonly cited legal obligations under GDPR, CCPA/CPRA, COPPA, TCPA, and others. It is not legal advice, and it never claims you are compliant or in breach: it hands you, and your lawyer, a ranked and cited list of the places where your code and an obligation plausibly meet.
Scope comes from a short profile you save first — jurisdictions, audience, data practices — so a B2B tool in one market is not graded like a consumer app in fifty. Every finding cites its authority, and every registry entry records the date its citation was last checked.
- Observation-altitude findings: what the code does and what a cited authority is commonly read to require — never “you broke the law”, never “you are in the clear”.
- Ranked by exposure shape — how cheaply an outsider can see it, whether a private plaintiff can sue, how damages multiply — never a single fake score.
- Profile-scoped: obligations apply only where your declared jurisdictions, audience, and data practices make them plausible.
- Send a finding to the loop and it becomes a tracked Request — fixed, tested, and shipped as a pull request.
- Re-runs reconcile: a finding auto-resolves only when its detector ran again and the evidence says covered. Silence never closes anything.
How the registry works
Each entry in the obligation registry gates on your profile, maps one concrete code observation to one commonly cited obligation, and cites its authority together with the date the citation was last verified against a primary source. The registry is versioned, and every report names the registry version it ran under, so two runs are always comparable. Where counsel has reviewed an entry, that is recorded as a fact — it is never inferred.
Ranked by exposure, not by fear
Findings are ordered by the shape of the exposure: how cheaply somebody outside the company can observe the behavior, whether it carries a private right of action, and how the damages multiply — per user, per message, per violation. They are never summed into a single number, because a score would claim a precision the law does not have.
Built to hand to your lawyer
The output is deliberately shaped as lawyer input, not a verdict: each finding pairs a specific code observation with a specific cited obligation, so the expensive conversation starts from evidence instead of from a blank intake call. The disclaimer below appears on every surface this scan produces — the tab, the report, the MCP output.
From finding to merged fix
Many legal-exposure findings are, at bottom, engineering gaps — a missing consent gate, an over-broad data capture, a retention job that never runs. Send a finding to the loop and it becomes a Request on your roadmap: planned, implemented in an isolated VM, verified through Keelen's test and review gates, and shipped as a pull request you can gate however you like.
Run it on your cadence
There is a Run button on the project tab, and there is an MCP tool — run_legal_exposure_review — so any agent or scheduler you already use can trigger a scan monthly, before a launch into a new market, or after a data-model change. Re-running is the intended workflow, not a spam generator: findings carry stable fingerprints, so a re-run reconciles against the last one — fixed findings resolve, new ones surface, dismissed ones stay dismissed.
Trigger it from any agent
claude mcp add --transport http keelen https://keelen.ai/mcp
Then the run_legal_exposure_review MCP tool starts a run — from Claude Code, Cursor, a cron job, or anything else that speaks MCP.
What it is not
This is an automated engineering review. It maps code observations to commonly cited legal obligations. It is not legal advice, and it is not a compliance certificate. It is not exhaustive: the absence of a finding is not evidence of compliance. A lawyer must review anything that matters.
Included on every paid plan
From $29 / month on Indie
FAQ
Can an AI tell me if my app is GDPR compliant?
No — and be suspicious of any tool that says yes. Compliance is a legal judgment about your whole business, not a property of a repository. What Keelen's Legal scan can do is read your code, find the places where what it does plausibly meets a commonly cited obligation under GDPR or other laws, cite the authority, and rank the exposure — a concrete, evidence-based starting point for the conversation with your lawyer.
What laws does the Legal scan know about?
The obligation registry currently spans commonly cited obligations under GDPR, CCPA/CPRA, COPPA, and TCPA, among others, each gated by your project profile so only plausible jurisdictions apply. Every entry carries its citation and the date that citation was last verified, and the registry version is stamped on every report.
Is this legal advice?
No. It is an automated engineering review that maps code observations to commonly cited legal obligations. It is not legal advice and not a compliance certificate, and the absence of a finding is not evidence of compliance. Its job is to make the conversation with your lawyer start from cited evidence instead of from zero.
How are findings prioritized?
By exposure shape, on three axes: how cheaply somebody outside the company can observe the behavior, whether the obligation carries a private right of action, and how damages multiply — per user, per message, per violation. There is deliberately no single compliance score.
What happens to a finding after the scan?
You triage it: dismiss is sticky and survives re-runs; send to loop turns it into a tracked Request that Keelen's autonomous loop implements and ships as a tested pull request. On the next run, a fixed finding auto-resolves only when its detector actually ran and the evidence supports it — silence never closes anything.
Which plans include the Legal scan?
Included on every paid plan, from Indie at $29/month. CMMC Level 2 controls are an Enterprise feature.