# Data Breach Notification Deadlines

> Who to notify after a data breach and by what date: all US states, SEC, HIPAA, GDPR, UK. Sourced.

- name: io.github.Nero-Engine/breach-notification-deadlines
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 79/100 flags: no-repository
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.Nero-Engine%2Fbreach-notification-deadlines
- tools: https://api.protogrid.dev/v1/servers/io.github.Nero-Engine%2Fbreach-notification-deadlines/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "breach-notification-deadlines": {
      "type": "http",
      "url": "https://breach-notification-deadlines.nerolabs.workers.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 98
- freshness: 100
- provenance: 45
- drivers: +website +reachable +uptime-95% +updated-10d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 64 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: who_to_notify (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_breach_laws (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_capabilities (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
- pass `tools.token_cost`: about 1,018 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 3, about 1,018 tokens to load them all
- tool set hash: 2d0a584271ee8d3cd7c986223b146fd5
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Nero-Engine/breach-notification-deadlines.svg)](https://protogrid.dev/servers/io.github.Nero-Engine/breach-notification-deadlines)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://breach-notification-deadlines.nerolabs.workers.dev/mcp (streamable-http, auth none, reachable true, uptime30d 0.94871795)

## Packages

_none_

## Tools (3)

- `list_breach_laws`: Lists breach notification laws with who is covered, which data types trigger them, encryption exemptions, every notice with its deadline rule and threshold, penalties and the official source. Filter by US state, country (ISO code or name) or scope (us_state, us_federal_sector, country, region). Free.
- `list_capabilities`: Lists coverage (US states, US federal sector rules, countries), the date the data was last checked, and related Nero Labs Rules servers. Free.
- `who_to_notify`: Works out every data breach notice a company owes and the deadline for each. Give affected (how many people in each US state or country), the data types exposed (for example ssn, drivers_license, payment_card, financial_account, medical, health_insurance, username_password, biometric, passport, dob, email_address), whether the data was encrypted with the key kept safe, the date the breach was discovered, and flags: sec_registrant (US public company), sector (hipaa_covered_entity, hipaa_business_associate, glba_financial, health_app, nydfs_licensee) and role (owner, or service_provider holding data for another company). Returns each notice owed (people affected, state attorneys general, credit bureaus, HHS, SEC Form 8-K, FTC, EU and UK data protection authorities, Canada, Australia) with the deadline as a date where the law sets a fixed period, the deadline rule in words, what the notice must contain, how to send it and the official source, earliest first. Unclear cases give the SAFE answer (notice treated as required) plus what it depends on. Free.