Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "eu-compliance": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

claude mcp add --transport http eu-compliance https://mcp.clevsec.one/mcp

[mcp_servers.eu-compliance]
url = "https://mcp.clevsec.one/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eu-compliance": {
      "type": "remote",
      "url": "https://mcp.clevsec.one/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "eu-compliance": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=eu-compliance&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLmNsZXZzZWMub25lL21jcCJ9"
}

{
  "servers": {
    "eu-compliance": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

{
  "mcpServers": {
    "eu-compliance": {
      "httpUrl": "https://mcp.clevsec.one/mcp"
    }
  }
}

extensions:
  "eu-compliance":
    enabled: true
    name: "eu-compliance"
    type: streamable_http
    uri: "https://mcp.clevsec.one/mcp"
    timeout: 300

Quality 94 / 100new

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations9 of 9 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 3,501 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stabilityn/a · weight 15

n/a
stability.changes, stability.rug_pulltool history recorded for 0 of the 7 days needed

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

9 tools, about 3,501 tokens to load them all · tool set 8e343691dc64 · checked 2026-10-20 20:46 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

no-repository

provenance55

liveness100

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-100% +updated-0d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://mcp.clevsec.one/mcp` streamable-http	none	yes	100%	254 ms	2026-07-28	2026-10-20

Tools (9)

`cra_reporting_check`read-only	Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.
`dora_checklist`read-only	Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.
`dora_classify_incident`read-only	Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know.
`gdpr_breach_decision`read-only	Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.
`gdpr_fine_estimate`read-only	Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine.
`nis2_gap_assessment`read-only	Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps.
`nis2_scope_check`read-only	Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide.
`privacy_notice_requirements`read-only	Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need.
`reporting_deadlines`read-only	Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "one.clevsec/eu-compliance",
  "title": "ClevSec EU compliance tools",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://mcp.clevsec.one/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.1.0",
  "websiteUrl": "https://clevsec.one/mcp/",
  "description": "Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act."
}