# ClevSec EU compliance tools

> Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.

- name: one.clevsec/eu-compliance
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 94/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/one.clevsec%2Feu-compliance
- tools: https://api.protogrid.dev/v1/servers/one.clevsec%2Feu-compliance/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "eu-compliance": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-0d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 94/100 (new)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 3,501 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 0 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 3,501 tokens to load them all
- tool set hash: 8e343691dc64807c40958777ab720fd3
- badge: [![protogrid quality](https://protogrid.dev/badge/one.clevsec/eu-compliance.svg)](https://protogrid.dev/servers/one.clevsec/eu-compliance)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.clevsec.one/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (9)

- `cra_reporting_check`: Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.
- `dora_checklist`: Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.
- `dora_classify_incident`: Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know.
- `gdpr_breach_decision`: Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.
- `gdpr_fine_estimate`: Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine.
- `nis2_gap_assessment`: Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps.
- `nis2_scope_check`: Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide.
- `privacy_notice_requirements`: Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need.
- `reporting_deadlines`: Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts.