DEVELOPER SDK V2.0
BUILD AUTONOMOUS WORKFLOWS
The Bidda Agentic SDKs allow your LLM agents, LangChain bots, and autonomous workflows to programmatically consume our source-verified intelligence library.
MCP SERVER: LIVE ON SMITHERY.AI · MCP.SO · GLAMA.AI
MODEL CONTEXT PROTOCOL
Bidda is available as an MCP server. Connect it to Claude.ai, Claude Desktop, Cursor, Windsurf, or any MCP-compatible AI tool. Your AI assistant gets twenty-five tools across three layers: discovery (browse the registry), runtime intelligence (compliance gating, dependency walking, jurisdiction bundles, MITRE ATT&CK threat-to-compliance mapping, change feeds), and self-serve compliance (signed attestations, control attestations, point-in-time records, governed runs and governance audit packs, OSCAL evidence export, coverage gap check, the obligation-delta feed, freshness checks, change alerts, jurisdiction comparison). Ten tools are free over the discovery tier across 10,085 verified records with no API key; the fifteen self-serve tools use your Bidda subscription key, and a free trial counts. Full node unlock ($0.01) goes through the Vault API or the Bidda site.
DISCOVERY:BROWSE THE REGISTRY
list_pillars
Returns all 39 sovereign compliance pillars with live node counts. Call first to map the regulatory landscape.
search_nodes
Keyword search across 10,085 nodes with optional pillar filter. Returns ID, title, pillar, and BLUF.
get_node
Fetch a node by ID. Returns the discovery summary and a direct link to the full vault entry.
get_latest_changesNEW
Regulatory change feed. Returns nodes updated in the last N days (default 30). Filter by pillar to track a domain.
RUNTIME INTELLIGENCE:AGENT DECISION-TIME TOOLS
check_action_complianceNEW
Pre-flight compliance check. Agent describes an action ("process EU resident biometric data") and gets a ranked list of regulations that may apply, plus a risk indicator (LOW / MODERATE / HIGH). The headline runtime gate.
get_dependency_chainNEW
Walk the prerequisite tree for any node. Buying one rule pulls in the 3-8 prior obligations the agent must already satisfy: the compliance moat made visible.
get_crosswalkNEW
Cross-framework mapping. Show how one rule corresponds to its equivalents in other regimes (GDPR Art 17 → CCPA → POPIA). Discovery dimensions are free; full values vault-gated.
get_jurisdiction_bundleNEW
All rules that apply in a market: eu, us, uk, au, sg, india, canada, china, south-africa, japan, brazil. Use when an agent enters a new jurisdiction.
get_mitre_mapping
NEW
MITRE ROSETTA STONE
The bridge between SOC and compliance. Pass a MITRE ATT&CK technique ID (T1566, T1486, T1078, …) or ATLAS ID (AML.T0020) and get the Bidda node plus its mapped compliance obligations:NIST 800-53 controls, ISO 27001 Annex A clauses, PCI DSS requirements, NIS2 articles, HIPAA, DORA. SOC engineers paste threat IDs; compliance officers get exact regulatory citations. Free. Covers the MITRE ATT&CK (Enterprise, Mobile, ICS), ATLAS, D3FEND and CAPEC frameworks.
TOPICS & SELF-SERVE COMPLIANCE
browse_topics
FREE
Browse the registry by cross-cutting topic (data breach notification, AI transparency, AML) across every pillar and jurisdiction. Pillars stay as they are; topics are an extra way in.
compare_jurisdictions
SUBSCRIBER
See how jurisdictions address a topic side by side, including where their numbers differ (a 72-hour vs 30-day breach deadline). It shows the real rules and does not rank which is stricter.
create_attestation
SUBSCRIBER
Save a signed, time-stamped record of which rules an agent relied on for a decision, with a public verify URL so anyone can confirm it is unchanged. An audit trail for autonomous workflows.
point_in_time
SUBSCRIBER
Get a signed record of which version of a rule was authoritative at a past date, anchored to the public history chain. For showing what a rule said at the moment an agent acted.
drift_check
SUBSCRIBER
Submit fingerprints of the rules your agent has cached and learn which changed or were withdrawn, so it re-grounds before acting on stale law. The per-call batch size scales with your plan. Pass your Bidda key as api_key; a free trial counts.
watch_changes
SUBSCRIBER
Watch specific rules and whole pillars and get an email or webhook when their primary source changes, so an agent or team hears about an amendment early. Pass your Bidda key as api_key; a free trial counts.
open_run
record_run_entry
consult_node
seal_run
get_run
get_audit_pack
NEW
SUBSCRIBER
Governed runs: record what your agent actually did across a whole task, then prove it. Open a run, then either append an entry per turn or use consult_node to fetch a rule and record a verified entry in one call - each verified entry pins the rule's exact version and integrity fingerprint at that moment, and can note the model and a private hash of the end user. Seal it into one signed run receipt, then export a governance audit pack with get_audit_pack: the receipt, every entry, an independent tamper check, and a map of the record-keeping obligations it provides evidence toward (EU AI Act Art. 12 logging and Art. 26 deployer duties, ISO/IEC 42001, NIST AI RMF). Verifies against our public key with no Bidda account. Built for support bots, agents and governance workflows.
create_control_attestation
NEW
SUBSCRIBER
Sign a tamper-evident record of one of your own controls or policies and the obligation nodes it maps to. Each obligation is pinned to its exact version and integrity fingerprint at signing time, so the record shows what you mapped against on that date. This is the design-side evidence ("we operate this control, mapped to these obligations") that sits next to governed runs (the operating-side evidence). Public verify URL; anyone can check it with no Bidda account. It is your own assertion and not a determination that the obligation is met.
gap_check
NEW
SUBSCRIBER
Give it the rules you cover; it returns the prerequisite rules the dependency graph links to them that you did not list - the "you missed the prerequisite obligation" gaps - plus any rule you cover that has been withdrawn. A coverage aid for a reviewer; it never ranks or declares compliance.
obligation_deltas
NEW
SUBSCRIBER
The obligation-level change feed: primary sources whose content changed or whose node was withdrawn, mapped to the obligations they affect, filterable by time, pillar or specific nodes. Answers "what obligations changed since I last reviewed?".
oscal_assessment_results
NEW
SUBSCRIBER
Export a governed run as a NIST OSCAL assessment-results document - the machine-readable evidence format GRC and audit tooling consumes. Reviewed-controls list the obligation nodes consulted; observations pin each to its version and integrity hash; props carry the independent chain + Merkle integrity self-check. Drop it straight into an OSCAL-aware pipeline. A sealed run is readable by id; an open run needs your key.
TRANSPARENCY LOG
NEW
PUBLIC
Every signed record Bidda issues - attestations, control attestations, point-in-time records and run receipts - is appended to a public, append-only Merkle transparency log built with the same construction as Certificate Transparency (RFC 6962). A signed tree head fixes the root over every record; anyone can request an inclusion proof (this record is in the log) or a consistency proof (an earlier log is an unaltered prefix of a later one - nothing was removed, re-ordered, or back-dated). It proves integrity and append-only history, and verifies against our published key with no Bidda account.
GET /api/v1/transparency/sth
The current signed tree head - size, root, signature.
GET /api/v1/transparency/proof?record_id=
Inclusion proof for one record, foldable to the signed root.
GET /api/v1/transparency/consistency?first=&second=
Proof the log only ever grew - append-only, tamper-evident.
GET /api/v1/transparency/entries
The raw leaf list, for auditors mirroring the log.
TRY IT NOW:NO SIGNUP
Every tool is a JSON-RPC call against https://bidda.com/mcp. Copy any block below into a terminal:
# PRE-FLIGHT COMPLIANCE CHECK
curl -X POST https://bidda.com/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "check_action_compliance",
"arguments": {
"action": "process EU resident biometric data",
"jurisdiction": "eu"
}
}
}'
# WALK A COMPLIANCE CHAIN
curl -X POST https://bidda.com/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "get_dependency_chain",
"arguments": {
"node_id": "iso-42001-risk-assess",
"max_depth": 2
}
}
}'
# WHAT CHANGED THIS MONTH?
curl -X POST https://bidda.com/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "get_latest_changes",
"arguments": {
"days": 30,
"pillar": "AI Governance"
}
}
}'
# ALL RULES IN A MARKET
curl -X POST https://bidda.com/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 4,
"method": "tools/call",
"params": {
"name": "get_jurisdiction_bundle",
"arguments": {
"jurisdiction": "singapore",
"limit": 25
}
}
}'
# MITRE TECHNIQUE TO COMPLIANCE (ROSETTA STONE)
curl -X POST https://bidda.com/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 5,
"method": "tools/call",
"params": {
"name": "get_mitre_mapping",
"arguments": {
"technique_id": "T1566"
}
}
}'
Inside Claude Desktop or Cursor, your agent reads these tool descriptions automatically and calls them as needed: no manual JSON-RPC. The curl examples are for terminal verification and CI smoke-tests.
COMPLIANCE SCANNER · LIVE · NO INSTALL · NO AUTH
SCAN FROM ANY CI
POST source code, a git diff, or any text to https://bidda.com/scan:receive a ranked list of regulatory nodes that may apply, plus a risk indicator (LOW / MODERATE / HIGH). One curl line; works inside GitHub Actions, GitLab CI, Jenkins, CircleCI, Gitea Actions, BitBucket Pipelines, pre-commit hooks, IDE extensions: anywhere code lives. No GitHub Action required.
INPUT
Any text up to 512 KB
Source files, a unified diff, a PR body, a Terraform plan, a Kubernetes manifest:anything. JSON or raw text.
OUTPUT
Ranked node matches
Top 10 (configurable, max 25) regulatory nodes scored by relevance, with risk_level, matched terms, BLUF, and direct vault unlock URLs.
COST
Free
Scanning queries the discovery tier:always free. Only the full vault unlock ($0.01 per node) costs anything, and only when you want the deterministic workflow.
DROP-IN EXAMPLES:COPY INTO YOUR CI CONFIG
# ANY CI:GENERIC CURL
# Pipe a diff straight to the scanner, fail if HIGH risk
git diff origin/main..HEAD | \
curl -sX POST https://bidda.com/scan \
-H "Content-Type: text/plain" \
--data-binary @- | \
jq -e '.risk_level != "HIGH"'
# GITHUB ACTIONS
- name: Bidda compliance scan
run: |
git diff origin/${{ github.base_ref }} | \
curl -sX POST https://bidda.com/scan \
-H "Content-Type: text/plain" \
--data-binary @- > scan.json
jq -r .summary scan.json
jq -e '.risk_level != "HIGH"' scan.json
# GITLAB CI
compliance:scan:
stage: test
script:
- git diff origin/main..HEAD |
curl -sX POST https://bidda.com/scan
-H "Content-Type: text/plain"
--data-binary @- > scan.json
- jq -r .summary scan.json
- jq -e '.risk_level != "HIGH"' scan.json
artifacts:
paths: [scan.json]
# GITEA ACTIONS (SELF-HOSTED)
- name: Bidda compliance scan
run: |
git diff origin/main..HEAD | \
curl -sX POST https://bidda.com/scan \
-H "Content-Type: application/json" \
-d "{\"content\": \"$(cat - | jq -Rs .)\", \"jurisdiction\":\"eu\"}" \
> scan.json
cat scan.json | jq .summary
# LOCAL PRE-COMMIT HOOK (.HUSKY / GIT HOOKS)
#!/usr/bin/env bash
# .husky/pre-commit hook to block HIGH-risk changes locally
diff=$(git diff --cached)
[ -z "$diff" ] && exit 0
echo "$diff" | curl -sX POST https://bidda.com/scan \
-H "Content-Type: text/plain" --data-binary @- |
jq -e '.risk_level != "HIGH"' || {
echo "❌ HIGH compliance risk detected. Run 'git diff --cached | curl -X POST https://bidda.com/scan' for details."
exit 1
}
# STRUCTURED JSON REQUEST
curl -X POST https://bidda.com/scan \
-H "Content-Type: application/json" \
-d '{
"content": "process EU patient biometric data for fraud scoring",
"jurisdiction": "eu",
"limit": 5
}'
RESPONSE SHAPE
{
"ok": true,
"scanned_bytes": 412,
"keywords_extracted": 17,
"keywords_sample": ["process","patient","biometric","data","fraud","eu","gdpr",...],
"risk_level": "HIGH",
"total_matches": 23,
"matches": [
{
"node_id": "eu-ai-act-high-risk-law-enforcement",
"title": "EU AI Act: High-Risk AI in Law Enforcement",
"pillar": "AI Governance & Law",
"version": "1.0.0",
"last_updated": "2026-04-22",
"score": 5,
"matched_terms": ["biometric","data","eu","fraud","process"],
"bluf": "Article 6 + Annex III classify biometric identification systems as high-risk...",
"discovery_url": "https://bidda.com/api/v1/nodes/eu-ai-act-high-risk-law-enforcement.json",
"vault_url": "https://bidda.com/api/v1/vault/nodes/eu-ai-act-high-risk-law-enforcement.json",
"site_url": "https://bidda.com/intelligence/eu-ai-act-high-risk-law-enforcement"
},
/* ...up to 24 more matches by relevance */
],
"summary": "Risk: HIGH. 23 regulatory matches found; returning top 10 by relevance.",
"documentation": "https://bidda.com/developer#scan"
}
PRIVACY
The scanner only reads the text you POST. Nothing is logged or persisted on Bidda's side: the endpoint is stateless. For regulated environments that can't send source code at all, the same logic is shipping in @bidda/scan (next release):a local npm CLI that keeps source on your runner and only fetches the public discovery index from Bidda.
WHY THIS BEATS A GITHUB ACTION
Works in every CI on the planet, not just GitHub. No marketplace install. No version pinning. No vendor lock-in. The endpoint is the product, and it's the same scoring engine that drives the check_action_compliance MCP tool, so an agent at runtime and a CI scan at PR-time see identical results.
HTTP STATUS CODES
200 - scan or discovery request succeeded
400 - body missing, under 10 characters, or invalid JSON
402 - vault node requested without a valid payment token
413 - body exceeds the 512 KB scan limit (split the diff and scan each chunk)
AUTH, LIMITS & CLI
The /scan endpoint needs no API key and no account - it is unauthenticated and stateless. There is no published per-request rate limit today; high-volume CI users should cache the discovery index between runs. A local @bidda/scan npm CLI - which keeps source on your own runner and fetches only the public discovery index - is on the roadmap for teams that cannot POST source code at all.
Claude.ai (Web)
1.
Go to
claude.ai → Settings → Connectors
2.
Click
Add Connector
3.
Paste the server URL and click
Connect
https://bidda.com/mcp
Bidda will appear as "Bidda Sovereign Intelligence" with 18 tools (10 free, 8 for subscribers). Enable per conversation.
Claude Desktop (App)
Add to your claude_desktop_config.json:
{
"mcpServers": {
"bidda": {
"command": "npx",
"args": [
"mcp-remote",
"https://bidda.com/mcp"
]
}
}
}
Requires Node.js. The mcp-remote package bridges stdio transport to the Bidda HTTP endpoint.
LISTED ON ALL MAJOR MCP REGISTRIES
Find and install Bidda from your preferred MCP directory. No manual config required.
SMITHERY.AI ↗
MCP.SO ↗
GLAMA.AI ↗
Ten MCP tools are free. No API key required
Ten MCP tools query the free discovery tier with no key. The nine self-serve compliance tools (compare_jurisdictions, create_attestation, point_in_time, drift_check, watch_changes, open_run, record_run_entry, seal_run, get_run) use your Bidda subscription key, and a free trial counts. To unlock the full 13-key node (deterministic workflow, actionable schema, primary citations), visit the node page at bidda.com or use the Vault API directly ($0.01 per unlock via Skyfire, L402, or Direct Base USDC).
TRY IT NOW. NO SETUP REQUIRED
Paste the server URL directly into Claude.ai → Settings → Connectors. Your AI assistant is connected in 30 seconds.
https://bidda.com/mcp
← COPY THIS
EXAMPLE: LIST_PILLARS RESPONSE
[
{ "pillar": "Cybersecurity", "nodes": 2448 },
{ "pillar": "Legal & IP Sovereignty", "nodes": 698 },
{ "pillar": "Banking & Global Finance","nodes": 584 },
{ "pillar": "AI Governance & Law", "nodes": 566 },
// ... 39 pillars total
]
🔗
Discovery API
Access the /api/v1/nodes/index.json endpoint for real-time registry discovery, or use the Technical Export tool in the Forest.
💎
Three Payment Paths
Listed on the Skyfire Directory. Skyfire pay+jwt for AI agents. L402/USDC on Base for Web3 wallets. Direct Base USDC live: headless, no account required, pass x-base-tx-hash header. $0.01 per compliance record, $5-$49 per pillar snapshot bundle (one-time, frozen JSON).
🛡️
Integrity Proofs
Every node includes a SHA-256 hash to ensure provenance and truth-verification.
Implementation Quickstart
No SDK or install needed for discovery. Plain fetch / requests works immediately. For the full SDK with helper classes, use the download link at the bottom of this page.
JAVASCRIPT
PYTHON
// No dependencies needed. Plain fetch works in Node.js 18+, Deno, and any browser
const BIDDA_BASE = 'https://bidda.com/api/v1';
const BIDDA_API_KEY = 'YOUR_BIDDA_API_KEY'; // from bidda.com/pricing - easiest path
// Alternative auth: 'skyfire-pay-id' (Skyfire JWT) or 'x-base-tx-hash' (Base USDC)
// 1. Discover all available nodes (free, no auth required)
const resp = await fetch(`${BIDDA_BASE}/nodes/index.json`);
const registry = await resp.json();
console.log(`Found ${registry.length} nodes`);
// 2. Preview a node for free (title, BLUF summary, integrity hash)
const preview = await fetch(`${BIDDA_BASE}/nodes/nist-csf-2-0-govern-function.json`);
const meta = await preview.json();
console.log(meta.bluf); // plain-English summary, no auth
// 3. Unlock the full node ($0.01) for deterministic workflow + citations
const vaultResp = await fetch(`${BIDDA_BASE}/vault/nodes/nist-csf-2-0-govern-function.json`, {
headers: { 'x-bidda-api-key': BIDDA_API_KEY }
});
const node = await vaultResp.json();
console.log(`${node.deterministic_workflow.length} compliance steps`);
console.log(node.actionable_schema);
// 4. Unlock an entire pillar bundle ($49 for cybersecurity snapshot)
const pillarResp = await fetch(`${BIDDA_BASE}/vault/pillar/cybersecurity.json`, {
headers: { 'x-bidda-api-key': BIDDA_API_KEY }
});
const pillar = await pillarResp.json();
console.log(`Pillar: ${pillar.node_count} nodes`);
CLI & AGENTIC NATIVE FETCH
Your agents don't need our interface. They can discover the forest metadata for free via the Discovery API, and hit the vault completely headless by submitting a Base USDC transaction hash as their L402 proof.
PROTOCOL: DECENTRALIZED X402
1. DISCOVERY CALL (FREE - NO AUTH)
curl https://bidda.com/api/v1/nodes/iso-42001-risk-assess.json
Returns node_id, title, domain, version, bluf, paywall. Free. Use to build discovery index and plan unlocks.
2. VAULT CALL (GATED - $0.01 PER NODE)
# No token → 402 with payment instructions:
curl https://bidda.com/api/v1/vault/nodes/iso-42001-risk-assess.json
# Path 1: Skyfire enterprise agent (pay+jwt):
curl https://bidda.com/api/v1/vault/nodes/iso-42001-risk-assess.json \
-H "skyfire-pay-id: <pay+jwt>"
# Path 2: Direct Base USDC (headless, no account):
curl https://bidda.com/api/v1/vault/nodes/iso-42001-risk-assess.json \
-H "x-base-tx-hash: 0xYOUR_TX_HASH"
# Path 3: Browser / MetaMask (L402 format):
curl https://bidda.com/api/v1/vault/nodes/iso-42001-risk-assess.json \
-H "Authorization: L402 web3:token:0xTxHash"
Returns full 13-key node: deterministic_workflow, actionable_schema, crosswalks, primary_citations.
Pillar Bundle Pricing
Bundles are one-time frozen snapshots: a single JSON payload of every node in the pillar at download time. Each bundle includes a snapshot_taken_at timestamp. Live regulatory change tracking, change alerts, and compliance receipts are subscription-tier features. Skyfire pay+jwt or Direct Base USDC accepted today; card checkout via Paystack coming soon.
SLUG PILLAR PRICE
workflow Workflow Automation $5
gaming Gaming & Gambling $9
biotech Biotech & Genomics $9
mining Mining & Natural Resources $9
space Space & Satellite Law $9
maritime Maritime & Shipping $9
industrial Industrial IoT & Energy $9
food Food & Hospitality $9
media Creative, Content & Media IP $9
crypto Crypto & Sovereign Finance $9
operations Operations & CX $9
competition Competition & Antitrust $9
automotive Automotive & Mobility $9
education Education & Research $9
telecoms Telecoms & Digital Infrastructure $9
tax Tax & Transfer Pricing $9
pharma Pharmaceuticals & Life Sciences $9
insurance Insurance & Risk $9
construction Construction & Real Estate $9
energy Energy & Utilities $9
sales Sales, Marketing & PR $9
aviation Aviation, Defense & Quantum $19
medical Medical & Healthcare $19
esg Sustainability & ESG $19
logistics Logistics & Supply Chain $19
cloud Cloud & SaaS $19
workplace Workplace $24
mitre MITRE Frameworks (ATT&CK + ATLAS + D3FEND + CAPEC), 204 nodes $29
ai-governance AI Governance & Law $39
finance Banking & Global Finance $49
legal Legal & IP Sovereignty $49
cybersecurity Cybersecurity $49
CRYPTO · LIVE NOW
# Fetch the MITRE Frameworks bundle via Skyfire
curl https://bidda.com/api/v1/vault/pillar/mitre.json \
-H "skyfire-pay-id: YOUR_PAY_JWT"
# Or pay direct USDC on Base, then present the tx hash
curl https://bidda.com/api/v1/vault/pillar/cybersecurity.json \
-H "x-base-tx-hash: 0xYOUR_BASE_TX_HASH"
FIAT (CARD) · COMING SOON
Card checkout for bundles is in approval with Paystack (international cards accepted, billed in ZAR). Need a bundle on a card today? Get in touch and we'll invoice you directly while card checkout is being switched on.
REQUEST A CARD INVOICE →
Under The Hood: Why is it secure?
Our system relies on physical Cloudflare Edge Architecture. When you pass your transaction's hash to our endpoints, our edge server executes an instantaneous JSON-RPC verification call to the live Base network. It cryptographically verifies that your transaction occurred, that it perfectly matched the required 0.01 USDC transfer (`0x2710` hex payload), and that you routed it to our exact Treasury wallet identifier.
DIAGNOSTICS MATRIX
SYMPTOM DIAGNOSIS RESOLUTION PATH
HTTP 402 Return (Despite Hash) The transaction hash was invalid, or RPC indexing latency occurred. Wait 30 seconds for Blockchain indexing, then retry the API call with the exact same hash. Do not rebuild the transaction.
"Verification Failed" Response The transaction succeeded, but the transfer logic did not match 0.01 USDC exactly to our treasury. Verify your web3 scripts are passing EXACTLY 0.01 into the token transfer parameter on Base.
Missing L402 Authorization Header Your autonomous agent attempted to fetch the payload without completing the preamble. Programmatically parse the HTTP 402 object to retrieve the dynamic invoice payload before fetching.
Node Freshness & The Hash-Staleness Model
Every node carries a version string and a SHA-256 integrity_hash. These values are updated whenever the underlying regulatory source changes - a new amendment, a revised annex, or a superseded standard. The free discovery endpoint always returns the current hash. The vault tier caches node content per payment session.
01
Discover & Cache Hash
Your agent calls /api/v1/nodes/{id}.json and stores the returned integrity_hash alongside the unlocked vault payload.
02
Detect Regulatory Changes
On every subsequent workflow run, re-fetch the free discovery endpoint. If the live integrity_hash no longer matches your cached hash, the node has been updated.
03
Repurchase for Freshness
Settle a new $0.01 USDC transaction to unlock the updated vault payload. The $0.01 is a freshness fee, not a content fee - you are paying for the guarantee that the logic is current law.
// PSEUDOCODE: AGENT-SIDE STALENESS CHECK
const cached = loadFromAgentMemory('iso-42001-risk-assess');
// Free discovery call - no payment required
const live = await fetch('https://bidda.com/api/v1/nodes/iso-42001-risk-assess.json');
const { integrity_hash, version } = await live.json();
if (cached.integrity_hash !== integrity_hash) {
// Node updated - cached workflow may be non-compliant
console.warn(`Node stale: cached ${cached.version} → live ${version}`);
const fresh = await agent.fetchNode('iso-42001-risk-assess'); // triggers $0.01 settlement
saveToAgentMemory('iso-42001-risk-assess', fresh);
}
// Run deterministic workflow using fresh.actionable_schema
⚠
Compliance risk: Running a cached node with a stale hash means your agent is executing against an outdated legal framework. In regulated industries this is not a performance issue - it is a liability. The hash check is the mechanism that eliminates this risk.
Registry Integrity Monitor
Every primary legal source behind every node is fingerprinted weekly by TLS SPKI hash and SHA-256 content hash. When a regulatory body amends an instrument, the fingerprint changes, and the diff enters our review queue within 7 days. The public health endpoint reports aggregate status with no auth required.
PUBLIC ENDPOINT: NO AUTH
curl https://bidda.com/api/v1/registry-health.json
{
"last_check_completed": "2026-05-25T02:00:00Z",
"next_scheduled_check": "2026-06-01T02:00:00Z",
"registry_total_nodes": 10085,
"unique_primary_sources_tracked": 3648,
"sources_with_changes_in_last_7_days": 3,
"last_check_summary": {
"unchanged": 3641,
"content_changed": 2,
"tls_changed": 1,
"fetch_failed": 4
},
"integrity_attestation": "SHA-256 + TLS SPKI. Manifest committed to git..."
}
What this endpoint tells you
→ How many sources were checked this cycle
→ How many had content or TLS changes in the last 7 days
→ When the next weekly check runs
→ Cryptographic attestation string for audit logs
What it does not expose
→ Which specific URLs changed (source-level detail)
→ TLS certificate fingerprints per source
→ The full source manifest (3,648 entries)
→ Per-node amendment history
Source-level detail is available to enterprise vault tier subscribers. The git commit chain at verification-reports/source-manifest.json is the tamper-evident audit artifact, with each weekly run as a new commit, creating a Merkle-anchored history of every regulatory source.
Compliance use case
Poll this endpoint weekly in your compliance pipeline. If sources_with_changes_in_last_7_days is non-zero, re-run staleness checks (see Hash-Staleness Model above) against your cached node inventory to identify which nodes need a fresh $0.01 vault unlock.
API RESPONSE SCHEMAS
PUBLIC METADATA (DISCOVERY)
{
"node_id": "nist-csf-2-0-govern-function",
"title": "NIST CSF 2.0 - GOVERN Function",
"domain": "Cybersecurity",
"version": "1.0.0",
"last_updated": "2026-04-16",
"bluf": "Establishes cybersecurity risk management strategy...",
"paywall": {
"status": "LOCKED",
"unlock_cost_usd": "0.01"
},
"verification": {
"authority": "NIST",
"source_url": "https://www.nist.gov/cyberframework",
"status": "VERIFIED",
"integrity_hash": "sha256:da792113..."
}
}
VAULT INTELLIGENCE (GATED)
{
"node_id": "nist-csf-2-0-govern-function",
"actionable_schema": {
"organizational_context_defined": false,
"cybersecurity_strategy_established": false,
"roles_and_responsibilities_defined": false,
"governance_oversight_body_established": false,
"failover_trigger": "NIST_CSF_GV_VIOLATION_DETECTED"
},
"deterministic_workflow": [
{
"step": 1,
"condition": "organizational_context_defined == false",
"action": "Establish and document the organizational context per GV.OC-01.",
"fallback": "Engage executive leadership to define and approve context statement."
}
],
"crosswalks": {
"iso_standard": "ISO/IEC 27001:2022 Clause 5.1, 5.2",
"nist_framework": "NIST SP 800-53 Rev 5: PM-9, RA-1"
},
"primary_citations": [
"NIST CSF 2.0, Function: GOVERN (GV)",
"NIST CSF 2.0, Category: Organizational Context (GV.OC)"
]
}
COMMON INTEGRATION PATTERNS
The most common ways developers plug Bidda into their stacks. All examples use public endpoints only - no proprietary logic is exposed.
LANGCHAIN TOOL
OPENAI FUNCTIONS
BATCH FETCH
402 RETRY LOOP
DIRECT USDC
Wrap a Bidda vault call as a LangChain Tool. The agent calls discover_bidda_node when it needs to verify a regulatory position. Reduced hallucination risk - it reads from source.
from langchain.tools import tool
import requests
BIDDA_BASE = "https://bidda.com/api/v1"
@tool
def discover_bidda_node(node_id: str) -> dict:
"""
Look up a Bidda compliance node by ID.
Returns the BLUF summary, authority, and integrity hash.
Free - no payment required.
"""
resp = requests.get(f"{BIDDA_BASE}/nodes/{node_id}.json")
resp.raise_for_status()
return resp.json()
@tool
def unlock_bidda_node(node_id: str, skyfire_token: str) -> dict:
"""
Unlock the full deterministic compliance workflow for a node.
Costs $0.01. Requires a Skyfire pay+jwt token.
Returns deterministic_workflow, actionable_schema, and primary_citations.
"""
resp = requests.get(
f"{BIDDA_BASE}/vault/nodes/{node_id}.json",
headers={"skyfire-pay-id": skyfire_token}
)
resp.raise_for_status()
return resp.json()
# Register both tools with your LangChain agent
tools = [discover_bidda_node, unlock_bidda_node]
LIVE ON PYPI · 25-TOOL MCP PARITY
BIDDA-SHIELD PYTHON SDK
Native Python SDK for LangChain, AutoGen, and CrewAI. One install gives your AI agents a compliance tool backed by 10,085 source-verified regulatory nodes. Reduced hallucination risk. Zero API wrangling.
PIP INSTALL BIDDA-SHIELD
BiddaShield
Full MCP-parity client: 10 methods including check_action_compliance, get_mitre_mapping, get_jurisdiction_bundle, get_dependency_chain. See the reference below for every method.
BiddaLangChainTool
Drop-in BaseTool subclass. Passes the compliance node JSON directly into the LangChain tool result. Agent decides when to invoke it based on the task context.
BiddaAutoGenTool / BiddaCrewAITool
Native integrations for AutoGen (function_schema + register(agent)) and CrewAI (CrewBaseTool subclass with _run()).
COMMAND LINE · NO CODE REQUIRED
BIDDA CLI
pip install bidda-shield installs a bidda command. Hit the live registry from any terminal — no Python file, no auth for the discovery tier. Every subcommand takes an optional --json flag for machine-readable output.
KEYWORD SEARCH
bidda search "GDPR" --limit 5
Returns the top 5 nodes matching "GDPR", ranked by relevance. Works for any regulation, MITRE technique ID (e.g. T1078) or multi-word topic.
COMPLIANCE PRE-FLIGHT
bidda check "process EU resident biometric data for access control" --jurisdiction eu
Natural-language risk check. Returns a LOW / MODERATE / HIGH verdict plus the ranked list of regulations that apply.
DEPENDENCY GRAPH WALK
bidda deps eu-ai-act-article-10-data-governance-training --depth 3
Walks the prerequisite chain for any node. Article 10 (data governance) pulls in Article 9 (risk management) and the high-risk classification — three levels deep, one command.
Other subcommands: bidda pillars, bidda node <id>, bidda mitre T1078, bidda jurisdiction eu, bidda crosswalk <id>, bidda changes. Vault tier (full 13-key node) unlocks with --vault + BIDDA_API_KEY env var.
FULL METHOD REFERENCE
BIDDA CLI + 25-TOOL MCP PARITY
Every tool exposed by the bidda.com/mcp MCP server is available as a Python method. Results match what an MCP client (Claude Desktop, any agent framework) would see for the same input. The SDK returns structured dict / list data, not LLM-formatted markdown.
list_pillars()
→ list[str] · All active sovereign pillars.
search_nodes(query, pillar=None)
→ list[dict] · Keyword search across the discovery index.
get_node(node_id, vault=False)
→ dict · Single node - discovery (free) or full vault ($0.01).
get_dependency_chain(node_id, max_depth=2)
→ dict · Walk the prerequisite tree. Most chains are 3-8 nodes deep.
get_crosswalk(node_id)
→ dict · Cross-framework mapping dimensions (GDPR → CCPA → POPIA, …).
get_latest_changes(days=30, pillar=None)
→ list[dict] · Regulatory change feed - newest amendments first.
get_jurisdiction_bundle(jurisdiction, limit=25)
→ dict · All nodes that apply in a market (eu, us, uk, sg, za, …).
get_mitre_mapping(technique_id)
→ list[dict] · MITRE technique → Bidda compliance node. ATT&CK, D3FEND, CAPEC, ATLAS.
check_action_compliance(action, jurisdiction=None, limit=10)
→ dict · Pre-flight risk check. Returns ranked matches + LOW / MODERATE / HIGH.
check_compliance(agent_action, regulation=None, vault=False)
→ dict · Convenience wrapper - returns just the top match.
RUNTIME COMPLIANCE GATE
PRIMARY USE CASE
The single most important call for autonomous agents: describe what the agent is about to do in natural language, get a ranked regulatory match list and a risk indicator. Halt or escalate when risk is HIGH.
from bidda_shield import BiddaShield
shield = BiddaShield()
result = shield.check_action_compliance(
"process EU resident biometric data for access control",
jurisdiction="eu",
limit=10,
)
# result = {
# "action": "...",
# "keywords": ["process", "biometric", "data", "access", "control"],
# "risk_level": "HIGH", # LOW | MODERATE | HIGH
# "match_count": 10,
# "matches": [
# {"node_id", "title", "domain", "bluf", "matched_terms", "score"},
# ...
# ]
# }
if result["risk_level"] == "HIGH":
# Surface the matched regulations to a human reviewer.
# Unlock the top match's full deterministic_workflow + actionable_schema:
full = shield.get_node(result["matches"][0]["node_id"], vault=True)
raise ComplianceGateError(
f"{result['match_count']} regulations apply - see {full['title']}"
)
LANGCHAIN INTEGRATION
LIVE
# pip install bidda-shield[langchain]
from bidda_shield import BiddaShield, BiddaLangChainTool
from langchain.agents import initialize_agent, AgentType
from langchain.chat_models import ChatOpenAI
shield = BiddaShield(skyfire_token="YOUR_SKYFIRE_TOKEN")
tool = BiddaLangChainTool(shield)
llm = ChatOpenAI(model="gpt-4o", temperature=0)
agent = initialize_agent(
tools=[tool],
llm=llm,
agent=AgentType.OPENAI_FUNCTIONS,
verbose=True
)
# Agent now self-grounds regulatory questions against primary law
result = agent.run(
"What are the data minimisation obligations under GDPR Article 5, "
"and how do they apply to our AI training pipeline?"
)
# Agent calls BiddaLangChainTool → fetches gdpr-article-5-data-principles
# Returns a source-verified answer, not a guess
AUTOGEN INTEGRATION
LIVE
# pip install bidda-shield[autogen]
from bidda_shield import BiddaShield, BiddaAutoGenTool
import autogen
shield = BiddaShield(skyfire_token="YOUR_TOKEN")
bidda_tool = BiddaAutoGenTool(shield)
assistant = autogen.AssistantAgent(
name="compliance_agent",
llm_config={"model": "gpt-4o"},
)
# Register the Bidda tool with the AutoGen agent
bidda_tool.register(assistant)
user_proxy = autogen.UserProxyAgent(
name="user",
human_input_mode="NEVER",
)
user_proxy.initiate_chat(
assistant,
message="Check ISO 27001 requirements for our SOC 2 audit"
)
CREWAI INTEGRATION
LIVE
# pip install bidda-shield[crewai]
from bidda_shield import BiddaShield, BiddaCrewAITool
from crewai import Agent, Task, Crew
shield = BiddaShield(skyfire_token="YOUR_TOKEN")
compliance_agent = Agent(
role="Compliance Analyst",
goal="Verify regulatory requirements against primary law",
backstory="Expert in EU AI Act, GDPR, and ISO standards",
tools=[BiddaCrewAITool(shield)],
verbose=True,
)
task = Task(
description="Review our AI system against EU AI Act high-risk requirements",
agent=compliance_agent,
expected_output="Checklist of obligations with primary citations",
)
crew = Crew(agents=[compliance_agent], tasks=[task])
crew.kickoff()
INSTALL OPTIONS
pip install bidda-shield
Core only: zero required dependencies (uses urllib.request fallback)
pip install bidda-shield[langchain]
Core + httpx + LangChain integration extras
pip install bidda-shield[autogen]
Core + httpx + AutoGen integration extras
pip install bidda-shield[crewai]
Core + httpx + CrewAI integration extras
pip install bidda-shield[all]
All frameworks: use for multi-framework environments
✓
Live on PyPI. pip install bidda-shield works today. View the package at pypi.org/project/bidda-shield. The full source is shipped inside the PyPI sdist for inspection.
Ready for Production?
Combine Bidda's source-verified intelligence with live payment infrastructure to build the next generation of autonomous B2B services. 10,085 nodes across 39 regulatory pillars are ready for integration today via Skyfire or L402.
API & INTEGRATION SUPPORT: [email protected]
DOWNLOAD FULL SDK PACK (.ZIP)
OR: PIP INSTALL BIDDA-SHIELD ↗