# Moltline RegClock

> Incident-reporting deadlines from the law: CRA, NIS2, DORA, GDPR, HIPAA, SEC 8-K. 6 of 9 tools free.

- name: com.moltlinestudio/regclock
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 84/100 flags: duplicate-repo
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.moltlinestudio%2Fregclock
- tools: https://api.protogrid.dev/v1/servers/com.moltlinestudio%2Fregclock/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "regclock": {
      "type": "http",
      "url": "https://mcp.moltlinestudio.com/regclock"
    }
  }
}
```


## Trust

- hygiene: 60
- liveness: 98
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-94% ~updated-42d-ago -duplicate-repo(22 names)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 2 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 3,895 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 3,895 tokens to load them all
- tool set hash: b38b791210eb15d049f7e63907b8a3e8
- badge: [![protogrid quality](https://protogrid.dev/badge/com.moltlinestudio/regclock.svg)](https://protogrid.dev/servers/com.moltlinestudio/regclock)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.moltlinestudio.com/regclock (streamable-http, auth none, reachable true, uptime30d 0.9385965)

## Packages

_none_

## Tools (9)

- `classify_event`: Apply a regime's statutory criteria to yes/no facts and name the event type. FREE.

Typical input {"regime": "eu_dora", "facts": {"critical_services_affected":
true, "duration_or_downtime": true, "geographic_spread": true}} returns
{"reportable": true, "event_type": "major_ict_incident", "reasoning":
[...], "criteria": {...}}. Unanswered questions are listed under "missing"
so the caller can go and find out. Use when deciding whether an incident
triggers a regime at all. Not for judging severity in the abstract: it
only applies the written criteria to the facts given. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "facts must be an object of question id -> answer"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `compute_deadlines`: Compute every reporting deadline of one regime from the moment of awareness. FREE.

Typical input {"regime": "eu_nis2", "event_type": "significant_incident",
"awareness_at": "2026-09-14T09:30:00+02:00"} returns {"deadlines":
[{"obligation": "early_warning", "due_at": "2026-09-15T09:30+02:00",
"citation": "Art. 23(4)(a)", ...}, ...]}. Later clocks that run from an
earlier submission are estimated from that report's due time until you
pass the actual time in submitted. DORA needs classification_at and a
country for the bank-holiday rule; the SEC needs
materiality_determined_at; HIPAA takes discovery_date and
flags.individuals_affected. Use when an incident has just been
identified and the agent needs the instants. Not for several regimes at
once: use compute_deadlines_multi. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "flags must be an object"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `compute_deadlines_multi`: One merged timeline across several regimes for the same incident. PREMIUM (license).

Typical input {"regimes": [{"regime": "eu_nis2"}, {"regime": "eu_gdpr"},
{"regime": "eu_dora", "entity_class": "credit_institution"}],
"awareness_at": "2026-09-14T09:30:00+02:00", "country": "DE"} returns
{"timeline": [rows sorted by due_at, each tagged with regime], "first_due":
{...}, "per_regime": {...}}. Each entry may carry its own event_type and
entity_class; the anchors and flags are shared. Use when one incident
triggers several regimes and the agent needs a single ordered list. Not
for one regime: compute_deadlines is free. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "regimes must be a non-empty list of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `deadline_status`: Mark each computed deadline open, due soon, overdue or submitted as of now. FREE.

Typical input {"deadlines": <rows from compute_deadlines>, "now":
"2026-09-15T08:00:00+02:00"} returns {"items": [{"obligation":
"early_warning", "status": "due_soon", "hours_remaining": 1.5, ...}],
"overdue": 0, "next_due": {...}}. Use when polling an incident timeline
or deciding what to escalate next. Not for computing the deadlines
themselves. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `explain_rule`: Quote the time limit, citation and required content for an obligation. FREE.

Typical input {"regime": "eu_cra", "event_type": "severe_incident",
"obligation": "final_report"} returns {"citation": "Art. 14(4)(c)",
"rule": "within one month after ...", "required_content": [...]}. Leave
obligation empty to get every obligation of the event type; leave
event_type empty on single-event regimes. Use when a caller needs the
rule's own words next to a computed date. Not for computing dates: use
compute_deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `holiday_calendar`: List the public holidays the engine uses for a country and year. FREE.

Typical input {"country": "IE", "year": 2026} returns {"holidays":
[{"date": "2026-01-01", "name": "New Year's Day"}, ...]}. Use when
checking why a business-day or bank-holiday adjustment landed where it
did, or to see whether a country/subdivision is supported. Not a legal
register of bank holidays: it is the `holidays` package's public-holiday
calendar, which is what compute_deadlines uses. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "country is required"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `list_regimes`: List the reporting regimes this server can compute, with citations. FREE.

Typical input {} returns {"regimes": [{"id": "eu_nis2", "name": ...,
"instrument": ..., "applies_from": ..., "event_types": [...]}, ...],
"verified_on": "2026-09-06"}. Use when choosing the regime id and
event_type for compute_deadlines or classify_event. Not for legal advice:
it reports what the instruments say and when the entry was last checked. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `timeline_export`: Export computed deadlines as an iCalendar file and CSV rows. PREMIUM (license).

Typical input {"deadlines": <rows from compute_deadlines or the
timeline from compute_deadlines_multi>, "incident_ref": "INC-2026-041"}
returns {"ics": "BEGIN:VCALENDAR...", "csv": "regime,obligation,...",
"events": 4}. Each dated deadline becomes a VEVENT with the citation in
the description and an alarm alarm_hours_before it; rows without a fixed
time limit are listed in the CSV only. Use when the timeline needs to
land in a calendar or a ticket. Not for computing deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `validate_report`: Check a draft report against the statutory content list and its deadline. PREMIUM (license).

Typical input {"regime": "eu_gdpr", "obligation":
"supervisory_authority_notification", "report": {"nature": "...",
"contact": "...", "consequences": "...", "measures": "..."}} returns
{"checklist": [{"item": "...", "found": true, "evidence": [...]}, ...],
"missing": [...], "coverage": 0.75, "timing": {...}}. The content check is
a keyword heuristic over the report text, reported as such; the timing
check compares submitted_at with due_at and, for GDPR, flags a late
notification that gives no reasons for the delay. Use before a report is
sent. Not a legal review, and it cannot judge quality, only presence. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.