{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_px9kw9qtjwck","handle":"clevsec-eu-compliance-tools","url":"https://wellknown.network/agents/clevsec-eu-compliance-tools","links":{"self":"https://wellknown.network/agents/clevsec-eu-compliance-tools/record.json","html":"https://wellknown.network/agents/clevsec-eu-compliance-tools","markdown":"https://wellknown.network/agents/clevsec-eu-compliance-tools/record.md","api":"https://wellknown.network/api/v1/agents/clevsec-eu-compliance-tools","status":"https://wellknown.network/api/v1/agents/clevsec-eu-compliance-tools/status","claim":"https://wellknown.network/agents/clevsec-eu-compliance-tools/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/clevsec-eu-compliance-tools/claim.json","badge":"https://wellknown.network/agents/clevsec-eu-compliance-tools/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/clevsec-eu-compliance-tools/history","tools":"https://wellknown.network/api/v1/agents/clevsec-eu-compliance-tools/tools"},"ard":{"identifier":"urn:air:mcp.clevsec.one:server:clevsec-eu-compliance-tools","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"ClevSec EU compliance tools","summary":"Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.","description":"Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.","publisher":{"name":"one.clevsec","url":null},"homepage":"https://clevsec.one/mcp/","repository":null,"version":"1.2.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://mcp.clevsec.one/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-20T21:27:46.678351Z","publishedAt":"2026-10-20T21:27:46.678351Z","registryName":"one.clevsec/eu-compliance"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"code.security-review","name":"Security Review","confidence":0.583,"provenance":"derived"},{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":0.554,"provenance":"derived"},{"slug":"dev.docs-lookup","name":"Documentation Lookup","confidence":0.54,"provenance":"derived"},{"slug":"ai.evaluation","name":"Evaluation & Benchmarks","confidence":0.54,"provenance":"derived"},{"slug":"commerce.pricing","name":"Pricing & Quotes","confidence":0.525,"provenance":"derived"},{"slug":"infra.devices","name":"Devices & IoT","confidence":0.525,"provenance":"derived"},{"slug":"content.writing","name":"Writing & Editing","confidence":0.51,"provenance":"derived"},{"slug":"commerce.payments","name":"Payments","confidence":0.51,"provenance":"derived"}],"categories":["ai","code","commerce","content","dev","infra"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 4h ago.","lastOkAt":"2026-10-24T04:23:53.310Z","lastProbedAt":"2026-10-24T04:23:53.310Z","statusComputedAt":"2026-10-24T04:26:01.212Z","reliability30d":{"probes":12,"successRate":1,"p50Ms":44,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":12,"ok":12,"authBoundaryOk":0,"serviceOk":12,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-24T04:23:53.310Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":31,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"65cec2e404c9645aaf697a9ca130f188f6a2cccb4a6b91c2e08819d5d42249b4","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T22:24:00.735Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":31,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"65cec2e404c9645aaf697a9ca130f188f6a2cccb4a6b91c2e08819d5d42249b4","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T15:31:55.637Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":48,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T09:29:44.230Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":99,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T02:23:43.225Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":31,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T19:31:17.340Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":56,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T12:30:08.708Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":67,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T05:31:41.993Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":46,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T22:31:12.882Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":78,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T12:28:28.737Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":52,"error":null,"detail":{"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"toolCount":28,"toolsHash":"ba35373d9ed0bb1987c52758505c6a55d82a40c6051e96e63f34d157ade22124","serverName":"clevsec","capabilities":["tools"],"serverVersion":"1.2.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"reporting_deadlines","description":"Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists wh"},{"name":"nis2_scope_check","description":"Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicat"},{"name":"nis2_gap_assessment","description":"Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domain"},{"name":"dora_classify_incident","description":"Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks wheth"},{"name":"dora_checklist","description":"Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entit"},{"name":"dora_gap_assessment","description":"Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, "},{"name":"gdpr_breach_decision","description":"Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide wh"},{"name":"gdpr_fine_estimate","description":"Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal"},{"name":"gdpr_checklist_assessment","description":"Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 a"},{"name":"gdpr_dpia_screening","description":"Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is req"},{"name":"privacy_notice_requirements","description":"Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 1"},{"name":"data_flow_record_check","description":"Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recip"},{"name":"cookie_consent_check","description":"Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to "},{"name":"cra_reporting_check","description":"Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art."},{"name":"iso27001_gap_assessment","description":"Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 contr"},{"name":"vendor_risk_assessment","description":"Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or D"},{"name":"maturity_assessment","description":"Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF func"},{"name":"cyber_risk_score","description":"Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted quest"},{"name":"nis2_remediation_plan","description":"Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"dora_remediation_plan","description":"Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, "},{"name":"gdpr_remediation_plan","description":"Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a "},{"name":"gdpr_dpia_report","description":"Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indica"},{"name":"data_flow_review","description":"Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate i"},{"name":"cookie_consent_fix_plan","description":"Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Pla"},{"name":"iso27001_remediation_plan","description":"Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended acti"},{"name":"vendor_due_diligence_plan","description":"Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 2"},{"name":"maturity_improvement_plan","description":"Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF"},{"name":"cyber_risk_action_plan","description":"Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references a"}],"package":null,"toolSurface":{"id":"ts_p8jhpgg5np9b","endpointId":"ep_vfxvcpqzjhn2","hash":"65cec2e404c9645aaf697a9ca130f188f6a2cccb4a6b91c2e08819d5d42249b4","toolCount":28,"serverName":"clevsec","serverVersion":"1.2.1","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-23T22:24:00.749Z","lastSeenAt":"2026-10-24T04:23:53.317Z","observations":2,"toolNames":["reporting_deadlines","nis2_scope_check","nis2_gap_assessment","dora_classify_incident","dora_checklist","dora_gap_assessment","gdpr_breach_decision","gdpr_fine_estimate","gdpr_checklist_assessment","gdpr_dpia_screening","privacy_notice_requirements","data_flow_record_check","cookie_consent_check","cra_reporting_check","iso27001_gap_assessment","vendor_risk_assessment","maturity_assessment","cyber_risk_score","nis2_remediation_plan","dora_remediation_plan","gdpr_remediation_plan","gdpr_dpia_report","data_flow_review","cookie_consent_fix_plan","iso27001_remediation_plan","vendor_due_diligence_plan","maturity_improvement_plan","cyber_risk_action_plan"],"distinctSurfaces":2},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"one.clevsec/eu-compliance","url":"https://registry.modelcontextprotocol.io/v0/servers/one.clevsec%2Feu-compliance","firstSeenAt":"2026-10-20T22:18:28.570Z","fetchedAt":"2026-10-20T22:18:28.570Z","normalizedAt":"2026-10-20T22:18:28.570Z"}]},"firstSeenAt":"2026-10-20T22:18:28.570Z","updatedAt":"2026-10-24T04:27:49.203Z"}