Categories › Business & Finance › Legal & compliance documents
Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR, Cyber Resilience Act and AI Act.
Remote server: your requests and data go to mcp.clevsec.one. Claude Code: claude mcp add --transport http clevsec-eu-compliance-tools https://mcp.clevsec.one/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
reporting_deadlines — Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber inis2_scope_check — Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sectornis2_gap_assessment — Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 quesdora_classify_incident — Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incdora_checklist — Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirementsdora_gap_assessment — Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (Igdpr_breach_decision — Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorigdpr_fine_estimate — Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. gdpr_checklist_assessment — Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 chgdpr_dpia_screening — Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impaprivacy_notice_requirements — Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected frodata_flow_record_check — Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, dacookie_consent_check — Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Callcra_reporting_check — Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its piso27001_gap_assessment — Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without ansvendor_risk_assessment — Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NISmaturity_assessment — Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilitiescyber_risk_score — Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to gagent_risk_check — Use when someone asks how risky an AI agent or assistant setup is ('is it safe to let our agent read email and send replies?', 'what are themcp_tools_check — Use before enabling an MCP server or connecting to an A2A agent ('is this MCP server safe to add?', 'check these tool descriptions'). Pass tai_act_scope_check — Use when someone asks whether the EU AI Act applies to an AI system or model, how it is classified or what they must do ('is our recruitmentnis2_remediation_plan — Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended dora_remediation_plan — Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended gdpr_remediation_plan — Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a regdpr_dpia_report — Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures withdata_flow_review — Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, conscookie_consent_fix_plan — Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePriiso27001_remediation_plan — Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap witvendor_due_diligence_plan — Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request frmaturity_improvement_plan — Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the ncyber_risk_action_plan — Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 amcp_tools_report — Use after mcp_tools_check when the user wants a review report or to see what changed since approval. Pass document (current tools/list respoNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.