# io.tooloracle/ampel

> AmpelOracle — 50-tool compliance traffic-light: Go/Caution/Stop signals for ESG, MiCA, AML.

- name: io.tooloracle/ampel
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 90/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.tooloracle%2Fampel
- tools: https://api.protogrid.dev/v1/servers/io.tooloracle%2Fampel/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "ampel": {
      "type": "http",
      "url": "https://tooloracle.io/ampel/mcp/"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 90
- drivers: +repository +namespace-matches-repo +dns-namespace +reachable +uptime-100% ~updated-166d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 64 (weight 30)

- warn `tools.descriptions`: 1 of 50 tools have a description under 20 characters
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: entity_list (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); audit_trail (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); ping (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 4,276 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 50, about 4,276 tokens to load them all
- tool set hash: b8e17dae4a3de5f352958ac89d9e74bd
- badge: [![protogrid quality](https://protogrid.dev/badge/io.tooloracle/ampel.svg)](https://protogrid.dev/servers/io.tooloracle/ampel)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://tooloracle.io/ampel/mcp/ (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (50)

- `article_status`: Detailed Ampel for a specific DORA article. Each check with GREEN/YELLOW/RED conditions and evidence.
- `assess_all`: Re-run full assessment for an entity. Recomputes Ampel statuses from all available evidence.
- `audit_trail`: Chain-linked audit log with integrity check.
- `azure_ad_check`: Live Azure AD integration: MFA registration %, risky users, conditional access policies. DORA Art. 9 evidence. Requires Azure AD config in integrations_config.json.
- `bafin_approve_send`: Approve BaFin report for submission (4-eyes principle). Creates signed approval evidence.
- `bafin_report_draft`: Generate ITS 2024/1772 compliant BaFin incident report draft. All mandatory fields per DORA Art. 19/20. Preview mode — requires board approval.
- `board_summary`: Executive board summary: overall score, top 5 risks, overdue findings, SLA breaches, concentration risk, evidence health, owner workload. Designed for management/board reporting.
- `bridge_approve`: Approve or reject a bridge resolution. On approval: creates signed evidence, upgrades Ampel to GREEN, logs to audit chain.
- `bridge_report`: Bridge gap analysis: classifies gaps by DATA/EVIDENCE/POLICY/WORKFLOW with closure path, owner, effort level.
- `bridge_resolve`: Start bridge resolution workflow. Generates templates (Risk Acceptance, Contract Renegotiation, Concentration Policy, Exit Strategy), tracks approval process. Call bridge_approve to sign off.
- `bridge_status`: Check status of all bridge resolution workflows for an entity. Shows open, pending, closed, rejected.
- `bus_status`: Oracle Event Bus status: events, cross-refs, connected oracles.
- `check_contract`: Check DORA Art. 30 contract clauses for a provider. Returns PASS/WARN/BLOCK with missing clauses and bridge classification.
- `collect_art10`: Collect live Art. 10 evidence from NVD, CISA KEV, CERT-Bund. Auto-assesses.
- `contract_analyze`: Analyze contract against 15 DORA Art. 30 mandatory clauses. Returns compliance status per clause with confidence score, extracted text, gap reasoning, suggested fix.
- `contract_status`: Overview of all analyzed contracts per entity. Shows clause gaps, review status, document versions.
- `contract_upload`: Upload contract text for DORA Art. 30 analysis. Creates document record with SHA-256 hash, version tracking, audit trail.
- `create_entity`: Register a new regulated entity.
- `create_trial`: Create temporary trial entity (48h) for self-service DORA assessment. No login needed.
- `cross_oracle_assess`: Enterprise cross-oracle assessment. Runs 18 checks across CyberShield (NIS2/ISO 27001), SupplyChainOracle (LkSG/CSRD), HealthGuard (MDR/GDPR), CFOCoPilot (XRechnung), TaxOracle (DAC6), LegalTechOracle (DORA contracts). Auto-stores evidence and updates Ampel status.
- `cross_regulation_check`: Tag findings with cross-regulation impact (DORA + MiCA + AMLR). Shows which DORA findings also affect MiCA insider info or AMLR screening.
- `cve_asset_map`: Map CVE/vulnerability to internal ICT providers and systems. Auto-creates findings for critical matches. DORA Art. 10.
- `dependency_graph`: Full provider dependency graph: providers, systems, checks, blast radius, SPOF detection.
- `entity_list`: List all registered regulated entities.
- `escalation_status`: Get findings, SLA breaches, escalation status per entity.
- `evidence_pack`: Export evidence pack for article/check/entity. Pruefer-ready: evidence, assessments, findings, audit trail, signatures.
- `evidence_summary`: All evidence artefacts for an entity with hashes and expiry dates.
- `freshness_check`: Run freshness watchdog. Expires stale evidence, downgrades GREEN->YELLOW->GREY if evidence too old.
- `gap_report`: DORA compliance gaps. RED/GREY/YELLOW items with priority and required actions.
- `generate_report`: Generate data-driven DORA Ampel PDF report. Score, gap analysis, provider register, audit trail integrity.
- `generate_trial_report`: Generate watermarked trial report with score, gaps, and CTA.
- `health_check`: Server + DB status.
- `incident_flow`: DORA incident lifecycle: log, classify, notify (BaFin), close. Each step creates signed evidence.
- `llm_clause_check`: LLM-based DORA Art. 30 contract analysis. Paste contract text, get clause-by-clause PRESENT/PARTIAL/MISSING for all 15 mandatory clauses. Uses Claude API.
- `onboard_entity`: Full entity onboarding: creates initial RED assessments for all 39 checks, collects auto-evidence from live sources, re-assesses, and returns readiness score.
- `ping`: Quick connectivity test.
- `policy_draft`: Generate DORA policy/framework document draft for a specific article. 8 templates available (Art. 5,6,8,10,11,17,28,30). Uses entity data for customization.
- `provider_country_risk`: Enrich provider dependencies with OECD economic risk: GDP, unemployment, CLI per provider country. DORA Art. 28-31 relevant.
- `readiness_check`: Full DORA readiness score + Ampel per article. Returns GREEN/YELLOW/RED/GREY for all 26 articles, score 0-100, days until deadline.
- `register_provider`: Register an ICT third-party provider for DORA Art. 28 Register of Information. Stores provider data and creates evidence.
- `regulation_impact`: Show cross-regulation impacts for a specific DORA article. Maps DORA → MiCA + AMLR.
- `reg_watchdog`: AI Regulatory Watchdog: scrapes EBA/ESMA/BaFin/CERT-Bund for DORA updates. Returns alerts with affected articles and severity. Run daily via cron or on-demand.
- `retest_finding`: Re-test a finding: collect fresh evidence, reassess check, auto-close if GREEN. Full closed-loop.
- `run_escalation`: Trigger escalation engine: auto-create findings, check SLA, escalate.
- `run_trial_assessment`: Run complete DORA+MiCA assessment for trial entity. Returns score, gaps, automation potential.
- `score_trend`: Score trend over time: weekly deltas, trajectory, peer benchmark. Shows improvement or decline.
- `servicenow_sync`: ServiceNow incident + change management sync. DORA Art. 17/21 evidence. Returns 30-day incident stats, classification, resolution rates.
- `update_finding`: Update finding lifecycle: claim, set remediation plan, request re-test, close, or accept risk. Status flow: open -> in_progress -> retest_pending -> closed | risk_accepted.
- `whatif_provider`: Simulate provider failure: which articles/checks are affected, score impact, risk level.
- `whatif_stale`: Simulate stale evidence: what happens if a check stays stale for N days.