mhfed/vn-law-check

What it does

vn-law-check is a set of rules and checklists that an AI coding agent loads to audit a website or mobile app against Vietnamese law. You ask the agent to run a legal audit; it reads the code or the site, flags risky spots with file and line references, names the article that applies, and can then apply fixes. The checks cover personal data protection, e-commerce, cybersecurity, advertising and AI rules that took effect in 2025–2026, along with consumer protection and electronic transactions.

It targets developers building for the Vietnamese market who need a first-pass review rather than a lawyer. Sites with email or phone fields, analytics and pixels, login, cart and checkout, or an AI chatbot fall in scope. Findings are graded red (fix now), yellow (should improve), green (passing) and grey (not applicable); a static blog with no data collection returns a single-line conclusion.

The rules are shipped in per-tool files so each agent reads its own location: AGENTS.md for Cursor, Codex and similar tools, CLAUDE.md and SKILL.md for Claude, plus Cursor rules, Windsurf rules, Copilot instructions and Cline rules. The same content is generated from one source by tools/sync.sh.

Quick start

The project is free and the only cost is the AI usage inside the tool you already run. Installation depends on the agent.

For Claude Code, run these inside Claude Code, not a terminal:

/plugin marketplace add mhfed/vn-law-check
/plugin install vn-law-check

For Cursor, Windsurf, Copilot, Cline or Codex, run this from a project directory using the install script:

curl -fsSL https://raw.githubusercontent.com/mhfed/vn-law-check/main/install.sh | bash

install.sh puts the checklist in .vn-law-check/ and does not overwrite existing files; if AGENTS.md or CLAUDE.md already exists, it appends a short pointer and avoids duplicates on re-runs. Alternatively you can clone the repo into ~/.claude/skills/vn-law-check for a global Claude skill as described in the installation options, or into .claude/skills/ for a single project.

Then open the project and ask:

audit pháp lý website này theo luật Việt Nam

If you only have a URL, you can pass it instead: audit pháp lý https://ten-mien-cua-ban.vn. Review the report, then ask the agent to fix the red items. A separate prompt, soạn chính sách bảo mật cho dự án này, drafts a privacy policy based on what the code actually collects and which services it sends data to, leaving company name and tax code blank for you to fill in. A sample report for a mock coffee shop is available in the demo.

Scanning behavior and data handling

scripts/scan.sh scans local source code, or calls fetch-site.sh to download up to 15 public pages and 20 same-domain JS files for a URL scan as described in the repository layout. Nothing is sent anywhere else. For mobile apps it checks permissions, tracking and ad SDKs, and account deletion features.

Auditing someone else's site is possible, but the README asks that results be sent privately to the site owner rather than published.

Limits and legal caution

The repo instructs the agent; it does not guarantee legally correct output. The author is a developer, not a lawyer, and marks unverified points as "CHƯA XÁC MINH" — as of writing there are several dozen, mostly around penalty amounts and Decree 356/2025. Treat red items as questions for a legal professional before publishing. The project itself says it cannot replace a lawyer; see the disclaimer.

An AI agent from the supported list is currently required to run the audit. Without one, the checklists under references/ can still be read manually as a self-check list. The referenced legal texts and their effective dates are listed in the legal sources file.

The code and repository structure are MIT licensed; the cited legal texts are public state documents and fall outside that license.

HotRepo's take

On the new-project board, vn-law-check recorded 170 stars and 43 forks during a roughly 16-hour growth window from 2026-11-02 to 2026-11-03, reaching 272 stars overall; it has no recorded GitHub daily all-language rank. That is a fast start for a repo created the same day, and it fits the niche it claims: existing compliance skills are largely GDPR and CCPA oriented, while Vietnam replaced much of its relevant law in 2025–2026. The project's own admission that penalty figures and some decree mappings remain unverified is the main thing to weigh before relying on its output.