Skip to main content
Glama
CSOAI-ORG

DORA Compliance MCP

🔏 Free tier: 50 calls/day. Need audit-ready proof?

Pro (£199/mo) turns every result into an HMAC-signed attestation with a public verify URL your auditor validates without an account — EU AI Act Art 11/12 ready. → Start: https://proofof.ai · pip install meok-attestation-verify to verify any cert.

MCP Scorecard: 90/100

Dora Compliance MCP

MEOK AI Labs PAYG enabled EU AI Act License PyPI

DORA (Regulation EU 2022/2554) compliance MCP for financial entities

DORA (Regulation EU 2022/2554) compliance MCP for financial entities. ICT risk, incident classification, reporting workflows. MIT


🚀 Quick Start

# Install via pip
pip install dora_compliance_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install dora-compliance-mcp --client claude

Related MCP server: EU AI Act Compliance MCP

⚡ Pay-per-call (PAYG) — no subscription

This MCP supports universal pay-per-call billing across the MEOK compliance fleet:

# One-time setup
export MEOK_PAYG_KEY="your_topup_token"

# Every tool call now deducts £0.05 from your balance.
# When balance hits zero, the tool returns a top-up URL.
# Works across all 7 MEOK compliance MCPs with the same token.
  • No subscription — top up once, deduct per call.

  • £0.05/call default (configurable via MEOK_PAYG_RATE_GBP).

  • USDC on Base L2 accepted — set MEOK_X402_RECEIVER and pay via stablecoin.

  • Backward-compatible — when MEOK_PAYG_KEY is unset, behaviour is unchanged.

Get a token: councilof.ai/payg (£10 / £50 / £200 top-up tiers).

✨ Features

  • MCP protocol compliant

  • Easy installation

  • Well-documented API

  • Production-ready

  • Active maintenance

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: £79/mo — Full MCP suite + EU AI Act tracking

  • Enterprise: £499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 26 PyPI packages · ~16,300 monthly installs.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

meok.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

📜 License

MIT © CSOAI-ORG


Configuration

Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:

{
  "mcpServers": {
    "dora-compliance-mcp": {
      "command": "uvx",
      "args": ["dora-compliance-mcp"]
    }
  }
}

Or: pip install dora-compliance-mcp then run the dora-compliance-mcp command (stdio transport).

Examples

Once configured, ask your assistant, for example:

  • "Use classify_entity to …"

  • "Use list_pillars to …"

  • "Use audit_pillar to …"

Available Tools

9 tools
audit_all_pillarsA

Run audits across all 5 DORA pillars and return an executive summary.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: entity_description (str): The entity description to analyze or process. current_controls (str): The current controls to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_descriptionYes
current_controlsNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It includes a comprehensive 'Behavioral Transparency' section covering side effects, authentication, rate limits, error handling, idempotency, and data privacy. All relevant behavioral traits are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is overly verbose with redundant sections (e.g., 'Behavior' repeats content from 'Behavioral Transparency'). While front-loaded with purpose, the structure could be tighter. Several sentences could be consolidated without loss of clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists (per context signals), the description does not need to detail return values. It mentions 'executive summary' and explains processing behavior. However, it lacks specifics about the output format, but this is acceptable since the output schema is presumably defined separately.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description's 'Args' section merely repeats parameter names with generic phrases like 'The entity description to analyze or process.' This adds no meaningful context beyond the schema, failing to compensate for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Run audits across all 5 DORA pillars and return an executive summary.' It uses a specific verb and resource, and distinguishes from siblings like audit_pillar (likely single pillar).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'When to use' and 'When NOT to use' sections, providing explicit context for usage and alternatives (e.g., not a substitute for legal counsel). This clearly guides the agent on appropriate invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_pillarA

Audit a specific DORA pillar (1-5) against your entity's current controls. Returns per-obligation pass/fail + gap list + remediation priority.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: pillar_number (int): The pillar number to analyze or process. entity_description (str): The entity description to analyze or process. current_controls (str): The current controls to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
pillar_numberYes
entity_descriptionYes
current_controlsNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but description fully covers: read-only, stateless, idempotent, no side effects, no auth required for basic tier, rate limits (10/day free, unlimited pro), structured error handling, data privacy no storage. Exceeds need for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections (main, behavior, when to use, args, behavioral transparency). Front-loaded key purpose. Slightly verbose but each section adds value. Could be trimmed slightly but overall efficient for complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given output schema exists (context signals), the description covers behavior, usage, parameters, rate limits, error handling, idempotency, data privacy, and authentication. Minor ambiguity with api_key parameter vs environment variable. No example output needed due to output schema. Adequate for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage 0%, but description's 'Args' section merely restates names and types from schema (e.g., 'pillar_number (int): The pillar number to analyze or process'). No added constraints, formats, or examples. 'api_key' description contradicts behavioral transparency which says passed via environment variable. Main text provides some context but parameter descriptions are tautological.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Audit a specific DORA pillar (1-5) against your entity's current controls' with specific verb, resource, and scope. It distinguishes from siblings like audit_all_pillars (all pillars) and list_pillars (just listing). Output includes pass/fail, gap list, and remediation priority.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections. States use for auditing, gap analysis, readiness checks; warns not a substitute for legal counsel. Implicitly differentiates from siblings like audit_all_pillars (full audit) and list_pillars (just listing).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

classify_entityB

Classify a financial entity's DORA applicability + which entity type it is. Returns in-scope status, entity type, proportionality tier, and starting pillars.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: description (str): The description to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
descriptionYes
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only and stateless (no side effects), authentication (none for basic, API key for pro), rate limits (free 10/day, pro unlimited), error handling (structured errors), idempotency, and data privacy. This is comprehensive and exceeds expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections and front-loaded with key information. However, it contains redundancy: the 'Behavior' paragraph and the 'Behavioral Transparency' section both mention read-only, stateless, rate limits, etc. This duplication adds unnecessary length. More concise organization would improve clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage, and behavioral details thoroughly. It mentions return values (in-scope status, entity type, etc.), and since an output schema exists, that is sufficient. However, the parameter documentation is severely lacking, leaving a gap in understanding how to provide input. The description does not explain what 'description' means or provide examples, which is a notable omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has two parameters with 0% coverage, so the description must compensate. However, the description merely repeats parameter names: 'description (str): The description to analyze or process.' This adds no semantic value and does not explain what kind of description is expected or how to format it, making it unhelpful for an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Classify a financial entity's DORA applicability + which entity type it is.' It lists specific outputs (in-scope status, entity type, proportionality tier, starting pillars), making the scope well-defined. However, it does not explicitly differentiate from sibling tools like classify_incident; the distinction is only implied by the tool name and context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides 'When to use' and 'When NOT to use' sections, offering some guidance (e.g., for gap analysis, not legal advice). It does not, however, compare this tool to siblings or specify when to prefer classify_entity over classify_incident or audit_pillar, leaving the agent to infer usage boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

classify_incidentA

Classify an ICT incident against DORA major-incident thresholds per Commission Delegated Regulation (EU) 2024/1772. Returns whether it qualifies as a 'major ICT incident' requiring 4h/72h/1-month reporting.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: incident_description (str): The incident description to analyze or process. clients_affected (int): The clients affected to analyze or process. duration_hours (float): The duration hours to analyze or process. economic_impact_eur (float): The economic impact eur to analyze or process. data_loss (bool): The data loss to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
incident_descriptionYes
clients_affectedNo
duration_hoursNo
economic_impact_eurNo
data_lossNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, stateless, idempotent, rate limits (10/day free), no authentication for basic use, error handling, and data privacy. This is comprehensive and beyond what structured fields would convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections, but contains redundancy: the 'Behavior' and 'Behavioral Transparency' sections overlap significantly. The 'Args' list is verbose with repetitive phrasing. Shortening would improve conciseness without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 parameters, 1 required), the description covers all necessary aspects: regulatory context, behavior, auth, rate limits, error handling, and output. The presence of an output schema reduces the need to describe return values, but the description still explains the key output (major incident qualification).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The 'Args' section repeats parameter names and adds generic phrases ('to analyze or process') that add no meaningful context beyond the schema titles. With 0% schema description coverage, the description fails to compensate by explaining valid values or DORA-specific meaning, e.g., what constitutes sufficient economic_impact_eur.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's purpose: classifying an ICT incident against DORA major-incident thresholds per EU regulation, and distinguishes it from sibling tools like classify_entity by focusing on incidents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance: use for compliance assessment, not as legal advice. This effectively helps the agent decide when to invoke the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enforcement_statusA

Current DORA enforcement status + key upcoming deadlines for financial entities.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The 'Behavioral Transparency' section comprehensively covers side effects (read-only, stateless, idempotent), authentication (no auth for basic, Pro/Enterprise require MEOK API key), rate limits (10/day free, unlimited Pro), error handling (structured errors), and data privacy (no storage). Since no annotations were provided, the description correctly carries the full burden of disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Behavior, When to use, Args, Behavioral Transparency) and front-loads the purpose. While it is lengthy, every sentence provides value. Minor redundancy exists (e.g., 'read-only' repeated), but overall it is appropriately sized for the detail needed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's purpose (enforcement status and deadlines) and the presence of an output schema, the description covers all necessary context: behavior, usage guidelines, parameters, and transparency. It does not need to explain return values as the output schema handles that. The description is complete for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter (api_key) with no description, and schema coverage is 0%. The description's Args section adds 'The api key to analyze or process', which provides some meaning, but it is vague about the key's purpose and when it's required (basic usage doesn't need it). This is adequate but not fully informative; it could clarify that the key is optional for basic usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides 'current DORA enforcement status + key upcoming deadlines for financial entities', which is a specific verb-resource combination. It distinguishes itself from sibling tools like audit_all_pillars and classify_entity by focusing on enforcement status rather than auditing or classification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly includes 'When to use' (assess, audit, verify compliance) and 'When NOT to use' (not a substitute for legal counsel) sections, providing clear guidance on appropriate usage. This directly helps the agent decide when to invoke this tool versus alternatives, even without naming siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dora_certificateA

Generate a cryptographically signed DORA compliance attestation (Pro/Enterprise).

Uses the shared MEOK attestation module (HMAC-SHA256 signed JSON + verify URL + optional base64-encoded PDF). Share the verify_url with your auditor / board / procurement team — the signature is cryptographically binding and any tampering invalidates it. Certificates expire 365 days from issue.

Args: entity_name (str): The entity name to appear on the certificate. overall_score (float): Overall compliance score (0–100). findings_csv (str): Comma-separated list of article-level findings (e.g. "Article 9: PASS,Article 28: GAP") articles_audited_csv (str): Comma-separated article numbers (e.g. "9,10,28") include_pdf_base64 (bool): Set True to also receive a board-ready PDF as base64. api_key (str): MEOK API key (Pro/Enterprise tier).

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_nameYes
overall_scoreYes
findings_csvNo
articles_audited_csvNo
include_pdf_base64No
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description covers important traits: cryptographic signing (HMAC-SHA256), output includes verify_url and optional PDF, signature is binding, certificate expires in 365 days. It doesn't mention side effects like storage or rate limits, but the core behavior is well disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening sentence, technical details, and an enumerated parameter list. It is informative without being excessively verbose, though the parameter descriptions could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the output format, expiration, and cryptographic binding. It mentions an output schema exists (though not shown), so return values are presumably documented. It lacks explicit prerequisites like needing prior audit data, but the tool's purpose is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description fully explains each of the 6 parameters, including their purpose and format (e.g., findings_csv as comma-separated list, include_pdf_base64 for PDF). This adds critical meaning beyond the schema's bare names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a cryptographically signed DORA compliance attestation. It specifies the target audience (Pro/Enterprise) and distinguishes from sibling tools like audit or classify, which are clearly different functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the output should be shared with auditors/board/procurement team, implying the tool is used after compliance checks. However, it doesn't explicitly state when to use or exclude alternatives, leaving room for ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_pillarsA

List all 5 DORA pillars with article ranges and key obligations.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

A dedicated 'Behavioral Transparency' section covers side effects (read-only), authentication (none for basic), rate limits (10/day free, unlimited pro), error handling, idempotency, and data privacy. With no annotations, the description fully bears the burden and does so excellently.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections, front-loading the purpose and behavior. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (list pillars) and the existence of an output schema, the description fully explains what the tool does, its behavioral characteristics, and usage context. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'api_key' has schema coverage 0%, and the description merely restates it: 'The api key to analyze or process.' It does not explain when to provide it or its effect, failing to compensate for the schema's lack of description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states: 'List all 5 DORA pillars with article ranges and key obligations.' This is a specific verb (list) and resource (DORA pillars), clearly distinguishing it from sibling tools like audit_all_pillars or classify_entity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear context: assessing, auditing, verifying compliance, gap analysis, and not for legal advice. No direct alternative mention, but siblings differentiate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

register_of_information_templateA

Return the Article 28.3 Register of Information template structure. Financial entities must submit this annually to their competent authority under DORA.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the detailed 'Behavioral Transparency' section covers side effects (read-only, no modifications), authentication, rate limits, error handling, idempotency, and data privacy extensively, fully compensating for the missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Behavior, When to use, Behavioral Transparency). While lengthy, each part adds value. A minor reduction in redundant phrasing could improve conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description focuses appropriately on usage and behavior. It covers all necessary aspects for a simple template-retrieval tool, though the parameter explanation could be more precise.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `api_key` has no schema description (0% coverage). The description adds that basic usage requires no authentication and pro/enterprise tiers need a MEOK API key via environment variable, but it ambiguously states the parameter is used to 'analyze or process'. More clarity on when the parameter is needed and its exact role would improve this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'the Article 28.3 Register of Information template structure', specifying the exact regulation (Article 28.3) and purpose (compliance template). This distinguishes it from sibling tools focused on auditing, classification, or certificate retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'When to use' (assess, audit, verify compliance, gap analysis) and 'When NOT to use' (not a substitute for legal counsel) sections, providing clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tlpt_readinessA

Assess Threat-Led Penetration Testing (Article 26) readiness. Returns whether the entity is likely in scope and what's needed to pass a TIBER-EU-aligned TLPT.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: entity_description (str): The entity description to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_descriptionYes
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description fully covers behavioral traits: read-only, stateless, idempotent, rate limits, authentication needs, error handling, and data privacy in dedicated 'Behavioral Transparency' section.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is lengthy with redundant sections ('Behavior' and 'Behavioral Transparency' overlap). Well-structured with headings but could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists (not needing return explanation) and two parameters, the description covers purpose, usage, and behavioral aspects well. Only parameter semantics are lacking, but overall complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, requiring description to compensate. The 'Args' section provides only generic descriptions ('The entity description to analyze') adding little meaning beyond parameter names. No constraints, examples, or formatting details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool assesses TLPT readiness and returns scope and requirements, distinguishing it from siblings like audit_all_pillars or classify_entity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use scenarios (gap analysis, readiness checks) and a clear when-not-to-use (not legal advice). Lacks explicit comparison to sibling tools but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 9 tool updatesv1.3.1
    • First observedaudit_all_pillars
    • First observedaudit_pillar
    • First observedclassify_entity
    • First observedclassify_incident
    • First observedenforcement_status
    • First observedget_dora_certificate
    • First observedlist_pillars
    • First observedregister_of_information_template
    • First observedtlpt_readiness

TDQS

A4.2/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: auditing all or specific pillars, classifying entities or incidents, checking enforcement status, generating certificates, listing pillars, providing template, and TLPT readiness. No two tools overlap in functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., audit_pillar, classify_incident, list_pillars). Naming is predictable and immediately conveys the action and target.

Tool Count5/5

9 tools is well-scoped for a DORA compliance server. Each tool earns its place, covering auditing, classification, status, certificate, and documentation needs without bloat or deficiency.

Completeness4/5

The tool set covers the core DORA compliance workflow: entity classification, pillar audits, incident classification, enforcement status, certificate generation, and templates. Minor gaps exist (e.g., no tool for tracking remediation or generating full reports), but the surface is largely complete for assessment and documentation.

Maintenance

ActivityStale
ResponsivenessSlow

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CSOAI-ORG/dora-compliance-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server