Moltline RegClock
Server Details
Incident-reporting deadlines from the law: CRA, NIS2, DORA, GDPR, HIPAA, SEC 8-K. 6 of 9 tools free.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Available Tools
9 toolsclassify_eventClassify EventARead-onlyIdempotentInspect
Apply a regime's statutory criteria to yes/no facts and name the event type. FREE.
Typical input {"regime": "eu_dora", "facts": {"critical_services_affected": true, "duration_or_downtime": true, "geographic_spread": true}} returns {"reportable": true, "event_type": "major_ict_incident", "reasoning": [...], "criteria": {...}}. Unanswered questions are listed under "missing" so the caller can go and find out. Use when deciding whether an incident triggers a regime at all. Not for judging severity in the abstract: it only applies the written criteria to the facts given. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "facts must be an object of question id -> answer"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| facts | Yes | answers keyed by the question ids returned for the regime (booleans; integers for counts). | |
| regime | Yes | regime id from list_regimes. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and idempotentHint annotations, the description details error behavior: 'never raises a protocol error' and instead returns an error object with guidance. It also discloses that unanswered questions are listed under 'missing,' and explicitly states it is safe to retry after correction. This adds operational context the annotations do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a one-sentence summary, followed by a compact example, usage guidance, error semantics, and safety note. Every section earns its place, though the stray 'FREE.' adds little signal and the overall text is on the longer side.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with a rich output schema, the description covers the input contract, example output, missing-answer behavior, and error handling. It leaves no significant gap an agent would need to infer before calling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters with 100% coverage, so the baseline is 3. The description adds value with a concrete example input ('{"regime": "eu_dora", ...}') and clarifies that facts are yes/no answers plus integer counts. This example helps an agent parameterize the call correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb-object pair ('Apply a regime's statutory criteria to yes/no facts and name the event type'), specifying both the action and the resource. It further disambiguates from sibling tools by stating it is 'not for judging severity in the abstract' and only applies written criteria. This gives an agent a precise mental model of the tool's unique role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides an explicit trigger condition: 'Use when deciding whether an incident triggers a regime at all.' It also gives a clear exclusion: 'Not for judging severity in the abstract,' which prevents misuse. It stops short of naming which sibling handles severity, so alternatives are only implied, not enumerated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compute_deadlinesCompute DeadlinesARead-onlyIdempotentInspect
Compute every reporting deadline of one regime from the moment of awareness. FREE.
Typical input {"regime": "eu_nis2", "event_type": "significant_incident", "awareness_at": "2026-09-14T09:30:00+02:00"} returns {"deadlines": [{"obligation": "early_warning", "due_at": "2026-09-15T09:30+02:00", "citation": "Art. 23(4)(a)", ...}, ...]}. Later clocks that run from an earlier submission are estimated from that report's due time until you pass the actual time in submitted. DORA needs classification_at and a country for the bank-holiday rule; the SEC needs materiality_determined_at; HIPAA takes discovery_date and flags.individuals_affected. Use when an incident has just been identified and the agent needs the instants. Not for several regimes at once: use compute_deadlines_multi. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "flags must be an object"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | condition answers: high_risk, processor, ongoing, handled_at, individuals_affected, max_residents_of_one_state, business_associate. | |
| regime | Yes | regime id from list_regimes. | |
| subdiv | No | optional subdivision code for the holiday calendar (e.g. BY for Bavaria). | |
| country | No | ISO 3166-1 alpha-2 code for the public-holiday calendar (DORA weekend rule; SEC uses US). | |
| submitted | No | actual submission times of earlier reports, e.g. {"initial_notification": "..."}. | |
| event_type | No | event type within the regime; optional when the regime has one. | |
| awareness_at | Yes | when the entity became aware, ISO 8601 with a UTC offset. | |
| entity_class | No | e.g. trust_service_provider (NIS2), credit_institution / central_counterparty / trading_venue_operator / nis2_essential_or_important (DORA), business_associate (HIPAA). | |
| discovery_date | No | HIPAA - the date the breach is treated as discovered (defaults to awareness date). | |
| classification_at | No | DORA - when the incident was classified as major. | |
| measure_available_at | No | CRA - when a corrective or mitigating measure became available. | |
| materiality_determined_at | No | SEC - when the incident was determined to be material. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the readOnly and idempotent annotations by disclosing the 15-second delay on the free plan, no pagination, error return strings, estimation behavior for later clocks, and safe retry after correcting input. This is rich behavioral context that annotations alone do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear purpose and includes a useful example, but it contains rambling and repetitive passages such as 'Typical output omits states in dry_run or disabled', 'Typical input shows a demonstration of the following...', and 'Also has a full breakdown of every event state.' These sentences add clutter without clear value, and 'FREE.' is ambiguous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description is complete: it covers the typical use case, regime-specific parameter requirements, actual submission handling, error behavior, plan-based delays, retry safety, and sibling-tool routing. The presence of an output schema also means return-value details do not need to be fully spelled out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaningful parameter context: DORA needs classification_at and country, SEC needs materiality_determined_at, HIPAA needs discovery_date and flags.individuals_affected, and the submitted object adjusts later deadline estimates. It does not describe every parameter in prose, but the schema already covers those individually.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: compute every reporting deadline of one regime from the moment of awareness. It also differentiates itself from siblings by explicitly naming compute_deadlines_multi and deadline_status, so the agent can distinguish this tool clearly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: use when an incident has just been identified and the agent needs the instants. It also gives exclusions with alternatives: not for several regimes at once (compute_deadlines_multi) and not for checking tomorrow's status (deadline_status).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compute_deadlines_multiCompute Deadlines MultiARead-onlyIdempotentInspect
One merged timeline across several regimes for the same incident. PREMIUM (license).
Typical input {"regimes": [{"regime": "eu_nis2"}, {"regime": "eu_gdpr"}, {"regime": "eu_dora", "entity_class": "credit_institution"}], "awareness_at": "2026-09-14T09:30:00+02:00", "country": "DE"} returns {"timeline": [rows sorted by due_at, each tagged with regime], "first_due": {...}, "per_regime": {...}}. Each entry may carry its own event_type and entity_class; the anchors and flags are shared. Use when one incident triggers several regimes and the agent needs a single ordered list. Not for one regime: compute_deadlines is free. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "regimes must be a non-empty list of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | condition answers shared by all regimes (see compute_deadlines). | |
| subdiv | No | optional subdivision code for the holiday calendar. | |
| country | No | ISO 3166-1 alpha-2 code for the public-holiday calendar. | |
| regimes | Yes | list of {"regime": id, "event_type"?: ..., "entity_class"?: ...} (1-10 entries). | |
| submitted | No | actual submission times keyed by "regime/obligation" or obligation id. | |
| awareness_at | Yes | when the entity became aware, ISO 8601 with a UTC offset. | |
| entity_class | No | default entity class for entries that do not set their own. | |
| discovery_date | No | HIPAA discovery date (defaults to the awareness date). | |
| classification_at | No | DORA classification instant. | |
| measure_available_at | No | CRA corrective-measure instant. | |
| materiality_determined_at | No | SEC materiality determination instant. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Although annotations already mark read-only and idempotent, the description adds crucial error behavior: invalid input never raises a protocol error but returns {'error': ...}, making retry safe. It also discloses that the tool is PREMIUM/licensed and sketches the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose, then example, then usage and error behavior, with no filler. Every sentence earns its place, including the license note and retry guarantee.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter nested tool with full schema coverage and an output schema, the description supplies the missing context: when to use it, how it differs from the free sibling, what errors look like, and high-level output shape. Nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description goes beyond the schema by showing a typical input object and clarifying that per-entry event_type/entity_class are overrides while anchors and flags are shared across regimes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening line names the exact deliverable: one merged timeline across several regimes for the same incident. It also differentiates from the single-regime sibling by saying 'Not for one regime: compute_deadlines is free.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states the trigger condition ('Use when one incident triggers several regimes and the agent needs a single ordered list') and the exclusion ('Not for one regime: compute_deadlines is free'). This gives the agent a clear routing rule among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deadline_statusDeadline StatusARead-onlyIdempotentInspect
Mark each computed deadline open, due soon, overdue or submitted as of now. FREE.
Typical input {"deadlines": , "now": "2026-09-15T08:00:00+02:00"} returns {"items": [{"obligation": "early_warning", "status": "due_soon", "hours_remaining": 1.5, ...}], "overdue": 0, "next_due": {...}}. Use when polling an incident timeline or deciding what to escalate next. Not for computing the deadlines themselves. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| now | Yes | the current instant, ISO 8601 with a UTC offset. | |
| deadlines | Yes | rows from compute_deadlines / compute_deadlines_multi (each with obligation and due_at). | |
| submitted | No | actual submission times keyed by obligation id (or "regime/obligation"). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, but the description adds materially richer behavioral detail: it never raises a protocol error on invalid input, instead returning a structured {'error': ...} object, and it explicitly says the call is safe to retry after corrections. This goes well beyond the annotation hints and sets clear expectations about failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear one-sentence summary followed by a concrete example, usage guidance, and error behavior. It is longer than average but every section earns its place. The 'FREE.' fragment is extraneous and the output example is slightly verbose, preventing a perfect score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with nested object parameters and an existing output schema, the description covers virtually everything an agent needs: input shape, example output, recommended use, exclusions, error contract, and retry safety. The presence of an output schema means the return format does not need further detail, and the description still provides a sample.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by showing a concrete typical input/output pair that ties 'deadlines' to rows from compute_deadlines and clarifies the expected shape of 'now'. The error example also adds a semantic constraint ('non-empty list of rows from compute_deadlines') not present in the schema, nudging this above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb ('Mark') on a specific resource ('each computed deadline') with concrete statuses ('open, due soon, overdue or submitted'). It clearly distinguishes the tool from compute_deadlines by saying 'Not for computing the deadlines themselves,' so an agent can tell it apart from sibling tools without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit recommended contexts ('Use when polling an incident timeline or deciding what to escalate next') and an explicit exclusion ('Not for computing the deadlines themselves'), effectively routing the agent away from compute_deadlines/compute_deadlines_multi. This is direct when-to-use guidance with alternative tools implicitly identified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_ruleExplain RuleARead-onlyIdempotentInspect
Quote the time limit, citation and required content for an obligation. FREE.
Typical input {"regime": "eu_cra", "event_type": "severe_incident", "obligation": "final_report"} returns {"citation": "Art. 14(4)(c)", "rule": "within one month after ...", "required_content": [...]}. Leave obligation empty to get every obligation of the event type; leave event_type empty on single-event regimes. Use when a caller needs the rule's own words next to a computed date. Not for computing dates: use compute_deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "unknown obligation '' for /; one of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| regime | Yes | regime id from list_regimes (eu_cra, eu_nis2, eu_dora, eu_gdpr, uk_gdpr, us_hipaa, us_sec_8k). | |
| event_type | No | event type within the regime (see list_regimes); optional when the regime has one. | |
| obligation | No | obligation id (for example early_warning); empty for all. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations that already declare read-only, idempotent, and non-destructive, the description adds a key behavioral trait: on invalid, missing, or malformed input this tool never raises a protocol error, returning an error object instead. It also states the practical consequence that after correcting input it is always safe to retry. This is valuable context the annotations do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and packs a lot of useful detail into a compact space, including an example and error behavior. It loses a point for the stray 'FREE.' and for repeating the read-only/idempotent facts already present in annotations, but overall the length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description doesn't need to define return fields, yet it still gives a realistic example. It covers all three parameters, typical and degenerate input, error mode, and retry safety, and it disambiguates from compute_deadlines. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond schema by explaining the meaning of empty values ('Leave obligation empty to get every obligation of the event type; leave event_type empty on single-event regimes') and providing a worked example with valid values. That elevates it above the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Quote the time limit, citation and required content for an obligation.' It also names the sibling it is not ('Not for computing dates: use compute_deadlines'), so an agent can distinguish it from the nearest alternative. The typical input/output example reinforces the function with concrete fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use when a caller needs the rule's own words next to a computed date' gives a positive context, and 'Not for computing dates: use compute_deadlines' gives an explicit exclusion. It also explains parameter-level usage: leaving obligation empty returns all obligations, and event_type can be empty on single-event regimes. This is complete routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
holiday_calendarHoliday CalendarARead-onlyIdempotentInspect
List the public holidays the engine uses for a country and year. FREE.
Typical input {"country": "IE", "year": 2026} returns {"holidays":
[{"date": "2026-01-01", "name": "New Year's Day"}, ...]}. Use when
checking why a business-day or bank-holiday adjustment landed where it
did, or to see whether a country/subdivision is supported. Not a legal
register of bank holidays: it is the holidays package's public-holiday
calendar, which is what compute_deadlines uses. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "country is required"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| year | Yes | calendar year. | |
| subdiv | No | optional subdivision code (state, province, region). | |
| country | Yes | ISO 3166-1 alpha-2 code (DE, FR, IE, US, ...). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses important runtime behavior: invalid, missing, or malformed input never raises a protocol error and instead returns a structured error object with fix guidance. It also provides a concrete input/output example and confirms retry safety after correcting input. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but mostly earns its length. The purpose, usage, example, error behavior, and safety note are all useful. Minor redundancy exists since read-only and idempotent are already in annotations, and 'FREE' adds no functional value for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for an agent to call the tool correctly: it states the input format, gives a typical example, explains the output shape, covers error behavior, and describes when to use it. Given the annotations and schema, nothing important for safe invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value beyond the schema by showing a typical input/output pair and clarifying that the tool can check whether a country/subdivision is supported, which gives practical meaning to the subdiv parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List the public holidays the engine uses for a country and year.' It clearly distinguishes this tool from siblings by noting it is the calendar compute_deadlines uses, and explicitly says it is not a legal register of bank holidays.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases: checking why a business-day/bank-holiday adjustment landed where it did, and checking whether a country/subdivision is supported. It also states a clear when-not: 'Not a legal register of bank holidays.' It does not name a direct sibling alternative, but the context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_regimesList RegimesARead-onlyIdempotentInspect
List the reporting regimes this server can compute, with citations. FREE.
Typical input {} returns {"regimes": [{"id": "eu_nis2", "name": ..., "instrument": ..., "applies_from": ..., "event_types": [...]}, ...], "verified_on": "2026-09-06"}. Use when choosing the regime id and event_type for compute_deadlines or classify_event. Not for legal advice: it reports what the instruments say and when the entry was last checked. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior, so the bar is lower, but the description adds substantial context: it reports what instruments say, includes a verified_on timestamp, never raises protocol errors but returns an error object, and is safe to retry. This goes well beyond the structured annotations and gives the agent accurate expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and uses the example and usage note effectively. It is slightly longer than necessary because it repeats the read-only/idempotent claims already present in annotations and includes the arguably unnecessary 'FREE' emphasis, but every other sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with rich annotations, the description is complete: it gives a concrete response example, explains when to use it, discloses limitations, specifies error behavior, and confirms retry safety. An agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema already documents an empty object. The description reinforces this with 'Typical input {}' and explains the shape of the response, which is helpful even though no parameter-level semantics are needed. This matches the 0-parameter baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List the reporting regimes this server can compute, with citations.' This clearly identifies what the tool does and distinguishes it from the sibling compute/classify operations by framing it as the discovery step for regime ids and event_types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use the tool: 'Use when choosing the regime id and event_type for compute_deadlines or classify_event.' It also adds a clear non-purpose boundary ('Not for legal advice'). It does not explicitly name an alternative tool to use instead, but the usage context is strong enough to route an agent correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
timeline_exportTimeline ExportARead-onlyIdempotentInspect
Export computed deadlines as an iCalendar file and CSV rows. PREMIUM (license).
Typical input {"deadlines": , "incident_ref": "INC-2026-041"} returns {"ics": "BEGIN:VCALENDAR...", "csv": "regime,obligation,...", "events": 4}. Each dated deadline becomes a VEVENT with the citation in the description and an alarm alarm_hours_before it; rows without a fixed time limit are listed in the CSV only. Use when the timeline needs to land in a calendar or a ticket. Not for computing deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| deadlines | Yes | rows from compute_deadlines / compute_deadlines_multi. | |
| incident_ref | No | your incident reference, prefixed to every event summary. | |
| calendar_name | No | X-WR-CALNAME for the calendar file. | Incident reporting deadlines |
| alarm_hours_before | No | hours before each due instant to fire a VALARM (0 disables). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and idempotentHint annotations, the description discloses concrete behavior: each dated deadline becomes a VEVENT with citation and alarm, undated rows appear only in CSV, invalid input returns an error object rather than raising a protocol error, and retrying is safe. This is rich, accurate behavioral detail that materially helps an agent invoke and interpret results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but dense and well-ordered: primary purpose first, then a concrete input/output example, behavioral specifics, usage guidance, error semantics, and retry safety. Every sentence adds useful information; there is no filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, an output schema, and rich annotations, this description is complete: it covers expected inputs, output format, edge cases, error behavior, idempotency, and read-only safety. An agent has everything needed to select and call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all four parameters. The description adds useful context beyond the schema: a typical input example, the expectation that deadlines rows come from compute_deadlines or compute_deadlines_multi, and how alarm_hours_before affects VEVENT alarms. This justifies a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Export computed deadlines as an iCalendar file and CSV rows.' It also distinguishes the tool from its compute-focused siblings by stating 'Not for computing deadlines,' so an agent can tell it apart from compute_deadlines and compute_deadlines_multi.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage context: 'Use when the timeline needs to land in a calendar or a ticket,' and an explicit exclusion: 'Not for computing deadlines.' It does not name the exact alternative tool to use for computing deadlines, but the sibling context and mention of compute_deadlines make the routing reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_reportValidate ReportARead-onlyIdempotentInspect
Check a draft report against the statutory content list and its deadline. PREMIUM (license).
Typical input {"regime": "eu_gdpr", "obligation": "supervisory_authority_notification", "report": {"nature": "...", "contact": "...", "consequences": "...", "measures": "..."}} returns {"checklist": [{"item": "...", "found": true, "evidence": [...]}, ...], "missing": [...], "coverage": 0.75, "timing": {...}}. The content check is a keyword heuristic over the report text, reported as such; the timing check compares submitted_at with due_at and, for GDPR, flags a late notification that gives no reasons for the delay. Use before a report is sent. Not a legal review, and it cannot judge quality, only presence. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""} (for example {"error": "unknown obligation '' for /; one of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| due_at | No | the computed due instant (from compute_deadlines), optional. | |
| regime | Yes | regime id from list_regimes. | |
| report | Yes | the draft, as an object of section name -> text (any keys). | |
| event_type | No | event type within the regime; optional when the regime has one. | |
| obligation | Yes | obligation id (for example incident_notification). | |
| submitted_at | No | when the report was or will be submitted, optional. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly, idempotent, and destructive annotations, the description discloses that the content check is a keyword heuristic, that timing compares submitted_at with due_at, that invalid input returns an error object rather than raising a protocol error, and that retrying is safe after corrections. This is exactly the behavioral context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but organized: purpose first, then a worked example, behavior, limitations, errors, and retry safety. Every sentence earns its place and adds operational value without filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich annotations and output schema, the description still adds essential context—heuristic limitation, error contract, licensing, timing semantics, and safe retry. For a tool with nested report objects and optional timing fields, it is complete enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds value: a concrete typical input mapping regime/obligation/report, links due_at to compute_deadlines, and explains submitted_at's role in timing. It does not elaborate on event_type, but the schema already documents it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and object: 'Check a draft report against the statutory content list and its deadline.' This clearly identifies the resource, the validation logic, and distinguishes it from sibling tools like classify_event or compute_deadlines.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use before a report is sent' and warns 'Not a legal review, and it cannot judge quality, only presence.' This gives clear when and when-not guidance. It does not name sibling alternatives for other validation tasks, so it stops short of an explicit alternatives matrix.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
9 tool updates
- First observed
classify_event - First observed
compute_deadlines - First observed
compute_deadlines_multi - First observed
deadline_status - First observed
explain_rule - First observed
holiday_calendar - First observed
list_regimes - First observed
timeline_export - First observed
validate_report
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
NIS2 tools: scope check, EU transposition, incident deadlines, and your own org's status (token).
IncidentOracle - 12-tool incident management MCP: triage, BaFin DORA reporting, RCA.
CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.
BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.
Related MCP Servers
- AlicenseBqualityBmaintenanceMulti-regime AI incident classification and reporting MCP supporting EU AI Act Article 73, DORA, NIS2, and GDPR breach reporting.3MIT
- AlicenseNot gradedqualityCmaintenanceBroadcasts Article 73 incident reports simultaneously to EU AI Act, DORA, NIS2, GDPR, and ISO 42001 regulators, with escalation workflows and audit trails.MIT
- FlicenseNot gradedqualityCmaintenanceEnables DORA-compliant ICT incident management through 12 MCP tools for logging, classifying, and reclassifying incidents, generating initial notifications and final reports, and tracking reporting deadlines. It supports major incident checks, incident dashboards, cyber threat notifications, and full incident register queries.-
- AlicenseAqualityCmaintenanceSource-verified regulatory and compliance intelligence: 10,000+ obligations across 39 pillars, each grounded in a primary legal source with a content hash. Covers the EU AI Act, GDPR, DORA, NIS2, HIPAA, Basel III and the MITRE ATT&CK/ATLAS families.251MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
Each tool targets a distinct stage of the incident-reporting workflow: classify_event qualifies the incident, compute_deadlines and compute_deadlines_multi produce deadlines, deadline_status monitors them, explain_rule cites the underlying rule, and timeline_export and validate_report handle output and pre-submission checks. No two tools are plausible substitutes; the single vs. multi-regime split between the two deadline tools is explicitly described.
Most action tools follow a verb_noun pattern (classify_event, compute_deadlines, explain_rule, list_regimes, validate_report), but three tools use noun_noun or reversed forms (deadline_status, holiday_calendar, timeline_export). The convention is readable but not uniform, making it a mixed pattern rather than a consistent one.
Nine tools is a well-scoped set for a regulatory deadline engine. Each tool maps to a necessary capability—discovery, classification, computation, status, explanation, calendar data, export, and validation—without redundant or filler entries.
The surface covers the full lifecycle: discover regimes, classify an incident, compute single or multi-regime deadlines, assess their status, inspect the statutory rule, export to calendar/CSV, and validate a draft report. Holiday and regime metadata tools fill supporting gaps, leaving no obvious dead-end for the stated purpose.