A
licenseNot graded
qualityC
maintenanceNIST RMF AI - MCP server providing AI-powered tools and automation by MEOK AI Labs
24
MIT
PCI DSS MCP
by CSOAI-ORG
This server provides tools for assessing and documenting PCI DSS 4.0 compliance across various security domains:
Assess Full PCI Compliance (
assess_pci_compliance): Evaluate an organization against all 12 PCI DSS 4.0 requirements (firewall, encryption, access control, logging, etc.) ā returns a comprehensive compliance gap analysis.Check Cardholder Data Flows (
check_cardholder_data): Analyze how cardholder data (PAN, CVV, PIN, track data) is stored and protected, verifying use of encryption, truncation, or tokenization.Network Segmentation Check (
network_segmentation_check): Verify proper network segmentation to reduce PCI DSS scope, including CDE isolation, firewall placement, and isolation of wireless/third-party networks.Vulnerability Scan Compliance Check (
vulnerability_scan_check): Evaluate vulnerability scanning practices against PCI DSS ASV requirements, tracking internal/external scans, pass/fail status, and quarterly cadence.Generate SAQ Templates (
generate_saq): Automatically generate a PCI DSS Self-Assessment Questionnaire (SAQ) template for a given organization and SAQ type (e.g., SAQ A, SAQ D) for readiness checks and compliance documentation.
Pci Dss MCP
PCI DSS 4
PCI DSS 4.0 payment card compliance MCP server ā 12 requirements assessment, cardholder data flow, network segmentation, SAQ generation
š Quick Start
# Install via pip
pip install pci_dss_mcp
# Or install via Smithery
npx -y @smithery/cli@latest install pci-dss-mcp --client claudeRelated MCP server: ISO 27001 AI MCP
āØ Features
MCP protocol compliant
Easy installation
Well-documented API
Production-ready
Active maintenance
š Documentation
š”ļø Compliance
This MCP server is built with EU AI Act compliance built-in:
ā Article 9 ā Risk Management System
ā Article 13 ā Transparency & Instructions for Use
ā Article 15 ā Bias Detection & Testing
ā Article 26 ā FRIA Support (where applicable)
ā Article 50 ā AI Content Watermarking (where applicable)
Need help getting compliant? Book a free 15-min diagnostic ā
š¢ Enterprise
Need custom development, SLA guarantees, or white-label deployment?
Pro: $99/mo ā Full MCP suite + EU AI Act tracking
Enterprise: $499/mo ā Custom dev + SLA + Dedicated support
View Pricing ā | Contact Sales ā
š¤ Part of the MEOK Ecosystem
This server is part of the MEOK AI Labs ecosystem ā 300+ MCP servers for sovereign AI governance.
Domain | Purpose |
EU AI Act compliance marketplace | |
AI safety & monitoring | |
Sovereign AI platform | |
Legacy modernization |
š License
MIT Ā© CSOAI-ORG
Pairs with MEOK Governance Suite
Build something that touches users? You need compliance. MEOK ships 38 governance MCPs that drop in alongside this tool ā EU AI Act, DORA, NIS2, CRA, GDPR, ISO 42001, FDA SaMD, MDR, Basel, MiFID II, MiCA, COPPA, and more.
# One-shot install of the governance pack
npx meok-setup --pack governanceFree tier: 10 calls/day per MCP. Pro tier (Ā£79/mo): unlimited + cryptographically signed compliance attestations your auditor verifies independently.
ā Full catalogue: councilof.ai/catalogue ā MEOK AI Labs: meok.ai
šø Try MEOK in 30 seconds ā instant buy ladder
Tier | Price | What you get | Stripe |
Smoke test | Ā£1 | Signed sample MCP-Hardening report + Article 50 PDF | |
Quick Kit | Ā£9 | EU AI Act Article 50 implementation guide (C2PA + EU-Icon) | |
Founder Call | Ā£29 | 30-min 1-on-1 with the founder |
Refundable. UK Stripe ā VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.
Configuration
Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:
{
"mcpServers": {
"pci-dss-mcp": {
"command": "uvx",
"args": ["pci-dss-mcp"]
}
}
}Or: pip install pci-dss-mcp then run the pci-dss-mcp command (stdio transport).
Examples
Once configured, ask your assistant, for example:
"Use
assess_pci_complianceto ā¦""Use
check_cardholder_datato ā¦""Use
network_segmentation_checkto ā¦"
Available Tools
5 toolsassess_pci_complianceA
Evaluate an organization against all 12 PCI DSS 4.0 requirements.
Behavior: This tool is read-only and stateless ā it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: organization_name (str): The organization name to analyze or process. merchant_level (int): The merchant level to analyze or process. has_firewall (bool): The has firewall to analyze or process. has_secure_config (bool): The has secure config to analyze or process. has_data_protection (bool): The has data protection to analyze or process. has_encryption_transit (bool): The has encryption transit to analyze or process. has_anti_malware (bool): The has anti malware to analyze or process. has_secure_sdlc (bool): The has secure sdlc to analyze or process. has_access_control (bool): The has access control to analyze or process. has_strong_auth (bool): The has strong auth to analyze or process. has_physical_security (bool): The has physical security to analyze or process. has_logging (bool): The has logging to analyze or process. has_security_testing (bool): The has security testing to analyze or process. has_security_policy (bool): The has security policy to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| organization_name | Yes | ||
| merchant_level | No | ||
| has_firewall | No | ||
| has_secure_config | No | ||
| has_data_protection | No | ||
| has_encryption_transit | No | ||
| has_anti_malware | No | ||
| has_secure_sdlc | No | ||
| has_access_control | No | ||
| has_strong_auth | No | ||
| has_physical_security | No | ||
| has_logging | No | ||
| has_security_testing | No | ||
| has_security_policy | No | ||
| caller | No | ||
| api_key | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4.1/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Provides a comprehensive 'Behavioral Transparency' section detailing read-only statelessness, idempotency, authentication, rate limits, error handling, and data privacy. This fully compensates for missing annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections, but the parameter list is repetitive (16 lines with 'to analyze or process') making it verbose. Could be more concise without repeating the same phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description does not explain the output format or how the 12 requirements are evaluated. Parameter descriptions are weak, leaving gaps for a compliance assessment tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description only adds generic phrases like 'The merchant level to analyze or process' for each of 16 parameters. This adds minimal meaning beyond the parameter name, failing to explain PCI-specific context like valid ranges for merchant_level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Evaluate an organization against all 12 PCI DSS 4.0 requirements', naming the specific standard and action. It clearly distinguishes from siblings like 'check_cardholder_data' and 'generate_saq' which are different tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Includes dedicated 'When to use' and 'When NOT to use' sections. Specifies use cases like assessment, gap analysis, and explicitly advises against substituting for legal counsel.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_cardholder_dataA
Analyze cardholder data flow for PCI DSS compliance.
Behavior: This tool is read-only and stateless ā it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: data_flow_description (str): The data flow description to analyze or process. stores_pan (bool): The stores pan to analyze or process. stores_cvv (bool): The stores cvv to analyze or process. stores_pin (bool): The stores pin to analyze or process. stores_track_data (bool): The stores track data to analyze or process. pan_encrypted (bool): The pan encrypted to analyze or process. pan_truncated (bool): The pan truncated to analyze or process. tokenization_used (bool): The tokenization used to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data_flow_description | Yes | ||
| stores_pan | No | ||
| stores_cvv | No | ||
| stores_pin | No | ||
| stores_track_data | No | ||
| pan_encrypted | No | ||
| pan_truncated | No | ||
| tokenization_used | No | ||
| caller | No | ||
| api_key | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4.1/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses side effects (none), authentication (optional), rate limits (10/day free), error handling, idempotency, and data privacy. This is thorough and honest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections, but redundant: 'Behavior' and 'Behavioral Transparency' overlap. The Args section could be trimmed since schema shows titles. Lengthy for the content conveyed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers usage, behavior, and limitations thoroughly. With an output schema present, missing output explanation is acceptable. Lacks examples or clarification for boolean parameters, but overall complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must compensate. However, the Args section merely repeats parameter names with generic phrases like 'The {name} to analyze or process,' adding no meaningful context beyond the schema's titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes cardholder data flow for PCI DSS compliance, with a specific verb and resource. It distinguishes from sibling tools by focusing on data flow analysis versus broader compliance assessment or documentation generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'When to use' and 'When NOT to use' sections, covering audit, gap analysis, and documentation. However, it does not directly compare with sibling tools or specify when to choose alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_saqA
Generate a PCI DSS Self-Assessment Questionnaire template.
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: organization_name (str): The organization name to analyze or process. saq_type (str): The saq type to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| organization_name | Yes | ||
| saq_type | No | D | |
| caller | No | ||
| api_key | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4.4/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description thoroughly covers behavioral traits: read-only (no side effects), authentication requirements, rate limits (10/day free), error handling, idempotency, and data privacy. All traits beyond what annotations would typically provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (Behavior, When to use, Args, Behavioral Transparency) and is front-loaded with the core purpose. While slightly lengthy, each section adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters, no annotations, and an output schema, the description provides comprehensive coverage of behavior, limitations, and usage guidance. It could clarify the output format or template content, but the presence of an output schema mitigates this gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. The 'Args' section only repeats parameter names and types ('organization_name (str)') without adding meaningful constraints, examples, or descriptions of valid values. Also fails to mention the 'caller' parameter from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Generate a PCI DSS Self-Assessment Questionnaire template,' which is a specific verb and resource. It distinguishes from sibling tools like assess_pci_compliance or vulnerability_scan_check, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'When to use' and 'When NOT to use' sections, providing clear context for when this tool is appropriate and warning against using it as legal advice. This helps the agent decide between alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_segmentation_checkA
Check network segmentation for PCI DSS scope reduction.
Behavior: This tool is read-only and stateless ā it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: has_segmentation (bool): The has segmentation to analyze or process. cde_isolated (bool): The cde isolated to analyze or process. segmentation_tested (bool): The segmentation tested to analyze or process. firewall_between_zones (bool): The firewall between zones to analyze or process. wireless_isolated (bool): The wireless isolated to analyze or process. third_party_isolated (bool): The third party isolated to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| has_segmentation | No | ||
| cde_isolated | No | ||
| segmentation_tested | No | ||
| firewall_between_zones | No | ||
| wireless_isolated | No | ||
| third_party_isolated | No | ||
| caller | No | ||
| api_key | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4.1/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description thoroughly covers side effects (read-only, stateless), authentication, rate limits, error handling, idempotency, and data privacy. This is exemplary beyond typical descriptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections and front-loaded purpose. However, the 'Behavior' and 'Behavioral Transparency' sections overlap slightly, and the 'Args' section is verbose without adding value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers many aspects: purpose, behavior, usage guidelines, error handling. Missing high-level output description (though output schema exists). Parameter explanations are weak. Overall adequate but not fully comprehensive given tool complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, the 'Args' section provides only generic restatements of parameter names (e.g., 'The has segmentation to analyze or process'), adding negligible semantic value. No explanation of how parameters affect output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a clear verb+resource: 'Check network segmentation for PCI DSS scope reduction.' It is distinct from siblings like assess_pci_compliance (broader) and vulnerability_scan_check (different focus).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Includes 'When to use' and 'When NOT to use' sections, but they are generic and do not explicitly differentiate from sibling tools. Provides context for compliance use but lacks comparative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_scan_checkA
Evaluate vulnerability scanning compliance per PCI DSS ASV requirements.
Behavior: This tool is read-only and stateless ā it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: last_external_scan_date (str): The last external scan date to analyze or process. last_internal_scan_date (str): The last internal scan date to analyze or process. external_scan_passed (bool): The external scan passed to analyze or process. internal_scan_passed (bool): The internal scan passed to analyze or process. asv_vendor (str): The asv vendor to analyze or process. quarterly_scans (bool): The quarterly scans to analyze or process. scan_after_changes (bool): The scan after changes to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| last_external_scan_date | No | ||
| last_internal_scan_date | No | ||
| external_scan_passed | No | ||
| internal_scan_passed | No | ||
| asv_vendor | No | ||
| quarterly_scans | No | ||
| scan_after_changes | No | ||
| caller | No | ||
| api_key | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
A4/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and excels. It explicitly states read-only, stateless, idempotent, safe, rate limits (free/pro), authentication needs, error handling, data privacy, and structured error responses. This is comprehensive and exceeds typical disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with sections but verbose. The 'Behavioral Transparency' section largely repeats the earlier 'Behavior' section. Parameter descriptions are repetitive and uninformative, making the text longer than needed without added value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While behavioral transparency is thorough and output schema exists, the weak parameter semantics and generic descriptions leave a significant gap. Agents may not understand how to properly use the 9 optional parameters, harming completeness for a tool with no required inputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% (schema has no descriptions). The description's 'Args' section lists all 9 parameters but provides generic definitions ('The ... to analyze or process') that add no real meaning beyond parameter names and types. This fails to clarify role or valid values, leaving agents guessing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool evaluates vulnerability scanning compliance per PCI DSS ASV requirements, which is a specific verb-resource pair. It distinguishes from siblings like assess_pci_compliance (broader compliance) and network_segmentation_check (different focus).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes 'When to use' and 'When NOT to use' sections, providing clear context for compliance assessment, gap analysis, and documentation generation. It warns against substituting legal advice but does not explicitly compare to sibling tools for when to choose this over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v1.0.4- First observed
assess_pci_compliance - First observed
check_cardholder_data - First observed
generate_saq - First observed
network_segmentation_check - First observed
vulnerability_scan_check
TDQS
A4.3/5.0
Disambiguation5/5
Each tool targets a distinct PCI DSS domain (overall compliance, cardholder data flow, SAQ generation, network segmentation, vulnerability scanning). There is no overlap; an agent can clearly differentiate them.
Naming Consistency5/5
All tool names follow a consistent verb_noun pattern in snake_case (e.g., assess_pci_compliance, generate_saq). The naming convention is uniform and predictable.
Tool Count5/5
With 5 tools, the server is well-scoped for PCI DSS compliance. Each tool serves a core function without being too sparse or bloated.
Completeness4/5
The set covers major PCI DSS areas: overall assessment, data flow, SAQ, network segmentation, and vulnerability scanning. Minor gaps exist (e.g., no tool for detailed requirement checks or remediation tracking), but the core workflow is covered.
Maintenance
ActivityStale
ResponsivenessNo issues
Related MCP Connectors
AI governance MCP server for EU AI Act compliance and jurisdiction verification
Agent Commerce Payments MCP Server by MEOK AI Labs
MEOK MCP Hardening MCP ā automated security red-team for any MCP server. Maps OWASP LLM Top 10
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
1
Related MCP Servers
ISO 27001 AI MCPofficial
AlicenseNot gradedqualityBmaintenanceISO 27001 AI - MCP server providing AI-powered tools and automation by MEOK AI Labs183MIT- AlicenseAqualityCmaintenanceISO 42001 AI - MCP server providing AI-powered tools and automation by MEOK AI Labs10161MIT
SOC2 Compliance AI MCPofficial
AlicenseAqualityCmaintenanceSOC2 Compliance AI - MCP server providing AI-powered tools and automation by MEOK AI Labs616MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/CSOAI-ORG/pci-dss-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server