mcp-dora

# mcp-dora — DORA Compliance Scanner **Digital Operational Resilience Act (EU) 2022/2554** compliance scanner as an MCP server. DORA has been in force since **January 17, 2025**. It applies to banks, payment institutions, investment firms, crypto CASPs, insurers, and ICT service providers operating in the EU. [](https://pypi.org/project/mcp-dora/) [](LICENSE) --- ## Quick Install ```bash pip install mcp-dora ``` Add to your Claude Desktop config (`~/.claude/claude_desktop_config.json`): ```json { "mcpServers": { "dora": { "command": "python3", "args": ["-m", "mcp_dora"], "env": {} } } } ``` Or use the CLI: ```bash dora-scanner /path/to/project --entity credit_institution ``` --- ## 7 Tools | Tool | DORA Articles | Plan | |------|--------------|------| | `scan_project` | Art.9, 10, 11, 17, 24, 25, 28, 31 | Free | | `classify_entity` | All | Free | | `assess_organization` | Art.5, 6, 11, 17, 18, 19, 26, 28, 30, 31 | Free | | `generate_report` | Combined | Free | | `generate_ict_register` | **Art.31** | Pro | | `generate_incident_template` | **Art.17-18** | Pro | | `certify_report` | All | Certified | ### `scan_project` Scans source code for DORA compliance gaps: - **Art. 9** — Hardcoded credentials, missing secrets management - **Art. 10 + 17** — Mutable logging files (tamper-prone incident records) - **Art. 11** — Missing retry logic and circuit breakers for external calls - **Art. 24 + 25** — Missing security testing tooling (bandit, semgrep, safety) - **Art. 28 + 31** — ICT third-party dependencies (AWS, Stripe, Kafka, etc.) ### `classify_entity` Returns all DORA articles applicable to your entity type: ``` credit_institution | payment_institution | e_money_institution investment_firm | crypto_casp | insurance_undertaking ict_provider | trading_venue | central_counterparty ``` ### `assess_organ…