Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.tooloracle/ampel

REMOTE · TOOLORACLE.IO

AmpelOracle — 50-tool compliance traffic-light: Go/Caution/Stop signals for ESG, MiCA, AML.

Available components

0 this week 77 Trust /100

Last scanned (4 hours ago)

Scores higher than 69% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Security

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security66
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • Authorisation not fully verified: no authorisation is required to call this server, and 50 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
  • DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
Schema Quality & AI Usability72
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 3177 tokens (~63/item across 50 items; 50 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage90
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 70% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "bafin_approve_send" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 50 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
  • Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Tool “llm_clause_check” rewrote its description, which is the text the model reads security
  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 26 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://tooloracle.io/ampel/mcp/

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=tooloracle.io CN=YE2,O=Let's Encrypt,C=US 13 Sept 2026 12 Dec 2026 ECDSA 256 ECDSA-SHA384 6375d594a6b9fdf6754e5a9a3d1f38b0dbd
SANs: mcp.tooloracle.io, tooloracle.io, www.tooloracle.io
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of tooloracle.io. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 38690 8 Verified
tooloracle.io. present 45856 8 Verified
tooloracle.io. Verified address RRset verified with the apex keys
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains; preload
content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.feedoracle.io https://tooloracle.io https://*.tooloracle.io https://fonts.googleapis.com wss://*.tooloracle.io; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none';
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy geolocation=(), microphone=(), camera=()

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://tooloracle.io/ampel/mcp/ Verified 200
http (plaintext) http://tooloracle.io/ampel/mcp/ HTTPS enforced 308 https://tooloracle.io/ampel/mcp/
MCP tools · 50 exposed · ~3,177 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
article_status ~54

Detailed Ampel for a specific DORA article. Each check with GREEN/YELLOW/RED conditions and evidence.

NameTypeReqDescription
articlestring–e.g. Art. 28
entity_idstring–Entity ID

No output schema declared.

No examples provided.

assess_all ~39

Re-run full assessment for an entity. Recomputes Ampel statuses from all available evidence.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

audit_trail ~34

Chain-linked audit log with integrity check.

NameTypeReqDescription
entity_idstring––
limitinteger–Max entries

No output schema declared.

No examples provided.

azure_ad_check ~56

Live Azure AD integration: MFA registration %, risky users, conditional access policies. DORA Art. 9 evidence. Requires Azure AD config in integrations_config.json.

NameTypeReqDescription
force_refreshboolean–Force fresh API call (default true)

No output schema declared.

No examples provided.

bafin_approve_send ~63

Approve BaFin report for submission (4-eyes principle). Creates signed approval evidence.

NameTypeReqDescription
approver_namestring––
approver_rolestring––
entity_idstring––
report_idstring––

No output schema declared.

No examples provided.

bafin_report_draft ~133

Generate ITS 2024/1772 compliant BaFin incident report draft. All mandatory fields per DORA Art. 19/20. Preview mode — requires board approval.

NameTypeReqDescription
affected_clientsstring––
affected_servicesstring––
classificationstring–major | significant | minor
descriptionstring––
entity_idstring––
incident_idstring––
remediationstring––
report_typestring–initial | intermediate | final
root_causestring––
titlestring––

No output schema declared.

No examples provided.

board_summary ~52

Executive board summary: overall score, top 5 risks, overdue findings, SLA breaches, concentration risk, evidence health, owner workload. Designed for management/board reporting.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

bridge_approve ~101

Approve or reject a bridge resolution. On approval: creates signed evidence, upgrades Ampel to GREEN, logs to audit chain.

NameTypeReqDescription
approved_bystring–Name + role of approver (e.g. Dr. Mueller, CISO)
rejectboolean–Set true to reject instead of approve
rejection_reasonstring–Reason for rejection (if rejecting)
resolution_idstring–Resolution ID from bridge_resolve

No output schema declared.

No examples provided.

bridge_report ~47

Bridge gap analysis: classifies gaps by DATA/EVIDENCE/POLICY/WORKFLOW with closure path, owner, effort level.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

bridge_resolve ~109

Start bridge resolution workflow. Generates templates (Risk Acceptance, Contract Renegotiation, Concentration Policy, Exit Strategy), tracks approval process. Call bridge_approve to sign off.

NameTypeReqDescription
check_idstring–Check to resolve: art30_c1, art30_c2, art30_c3, art8_c3, art31_c1
entity_idstring–Entity ID (optional)
expiry_daysinteger–Days until resolution expires (default 30)

No output schema declared.

No examples provided.

bridge_status ~40

Check status of all bridge resolution workflows for an entity. Shows open, pending, closed, rejected.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

bus_status ~37

Oracle Event Bus status: events, cross-refs, connected oracles.

NameTypeReqDescription
entity_idstring–Entity ID for cross-refs

No output schema declared.

No examples provided.

check_contract ~140

Check DORA Art. 30 contract clauses for a provider. Returns PASS/WARN/BLOCK with missing clauses and bridge classification.

NameTypeReqDescription
cif_clausesarray–CIF clauses if applicable
entity_idstring––
exit_strategyboolean–Exit strategy documented?
is_cifboolean–Is this a CIF (Critical/Important Function) provider?
provider_idstring–Provider ID
standard_clausesarray–Present standard clauses: service_description, data_location, data_protection, service_availability_sla, incident_notification, audit_right, termination_notice, cooperation_with_authorities

No output schema declared.

No examples provided.

collect_art10 ~45

Collect live Art. 10 evidence from NVD, CISA KEV, CERT-Bund. Auto-assesses.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

contract_analyze ~54

Analyze contract against 15 DORA Art. 30 mandatory clauses. Returns compliance status per clause with confidence score, extracted text, gap reasoning, suggested fix.

NameTypeReqDescription
document_idstring–Document ID from contract_upload

No output schema declared.

No examples provided.

contract_status ~36

Overview of all analyzed contracts per entity. Shows clause gaps, review status, document versions.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

contract_upload ~105

Upload contract text for DORA Art. 30 analysis. Creates document record with SHA-256 hash, version tracking, audit trail.

NameTypeReqDescription
contract_textstring–Contract text (extracted from PDF)
document_typestring–ict_outsourcing_agreement | dpa | sla | master_service_agreement
entity_idstring–Entity ID
file_namestring–Original file name
provider_namestring–Provider name

No output schema declared.

No examples provided.

create_entity ~46

Register a new regulated entity.

NameTypeReqDescription
entity_typestring–Type
jurisdictionstring––
leistring––
namestring–Entity name

No output schema declared.

No examples provided.

create_trial ~100

Create temporary trial entity (48h) for self-service DORA assessment. No login needed.

NameTypeReqDescription
entity_namestring–Institute name
entity_typestring–credit_institution|payment_institution|insurance_undertaking|asset_management|credit_institution_casp
jurisdictionstring–DE|AT|FR|etc
providersstring–Comma-separated provider names: AWS,SWIFT,Finastra

No output schema declared.

No examples provided.

cross_oracle_assess ~113

Enterprise cross-oracle assessment. Runs 18 checks across CyberShield (NIS2/ISO 27001), SupplyChainOracle (LkSG/CSRD), HealthGuard (MDR/GDPR), CFOCoPilot (XRechnung), TaxOracle (DAC6), LegalTechOracle (DORA contracts). Auto-stores evidence and updates Ampel status.

NameTypeReqDescription
checksstring–Comma-separated check IDs or omit for all
entity_idstring–Entity to assess

No output schema declared.

No examples provided.

cross_regulation_check ~53

Tag findings with cross-regulation impact (DORA + MiCA + AMLR). Shows which DORA findings also affect MiCA insider info or AMLR screening.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

cve_asset_map ~69

Map CVE/vulnerability to internal ICT providers and systems. Auto-creates findings for critical matches. DORA Art. 10.

NameTypeReqDescription
cve_idstring–CVE identifier
entity_idstring––
vendorstring–Vendor/software name to check

No output schema declared.

No examples provided.

dependency_graph ~36

Full provider dependency graph: providers, systems, checks, blast radius, SPOF detection.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

entity_list ~14

List all registered regulated entities.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

escalation_status ~33

Get findings, SLA breaches, escalation status per entity.

NameTypeReqDescription
entity_idstring–Entity ID (empty=all)

No output schema declared.

No examples provided.

evidence_pack ~70

Export evidence pack for article/check/entity. Pruefer-ready: evidence, assessments, findings, audit trail, signatures.

NameTypeReqDescription
articlestring–DORA article e.g. Art. 10
check_idstring–Specific check ID
entity_idstring–Entity ID

No output schema declared.

No examples provided.

evidence_summary ~33

All evidence artefacts for an entity with hashes and expiry dates.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

freshness_check ~47

Run freshness watchdog. Expires stale evidence, downgrades GREEN->YELLOW->GREY if evidence too old.

NameTypeReqDescription
entity_idstring–Entity ID (optional, checks all)

No output schema declared.

No examples provided.

gap_report ~38

DORA compliance gaps. RED/GREY/YELLOW items with priority and required actions.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

generate_report ~57

Generate data-driven DORA Ampel PDF report. Score, gap analysis, provider register, audit trail integrity.

NameTypeReqDescription
entity_idstring–Entity ID (optional)
formatstring–json (meta) or pdf (download)

No output schema declared.

No examples provided.

generate_trial_report ~38

Generate watermarked trial report with score, gaps, and CTA.

NameTypeReqDescription
entity_idstring––
trial_idstring––

No output schema declared.

No examples provided.

health_check ~13

Server + DB status.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

incident_flow ~117

DORA incident lifecycle: log, classify, notify (BaFin), close. Each step creates signed evidence.

NameTypeReqDescription
actionstring–log | classify | notify | close
classificationstring––
descriptionstring––
entity_idstring–Entity ID
incident_idstring––
lessons_learnedstring––
report_typestring––
root_causestring––
severitystring––
titlestring––

No output schema declared.

No examples provided.

llm_clause_check ~92

LLM-based DORA Art. 30 contract analysis. Paste contract text, get clause-by-clause PRESENT/PARTIAL/MISSING for all 15 mandatory clauses. TEMPORARILY DISABLED (returns TOOL_TEMPORARILY_DISABLED).

NameTypeReqDescription
contract_textstring–Contract text (plain text from PDF). Paste key sections.
provider_namestring–Provider name e.g. Salesforce

No output schema declared.

No examples provided.

onboard_entity ~51

Full entity onboarding: creates initial RED assessments for all 39 checks, collects auto-evidence from live sources, re-assesses, and returns readiness score.

NameTypeReqDescription
entity_idstring–Entity ID to onboard

No output schema declared.

No examples provided.

ping ~11

Quick connectivity test.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

policy_draft ~107

Generate DORA policy/framework document draft for a specific article. 8 templates available (Art. 5,6,8,10,11,17,28,30). Uses entity data for customization.

NameTypeReqDescription
dora_articlestring–dora_art5|dora_art6|dora_art8|dora_art10|dora_art11|dora_art17|dora_art28|dora_art30
entity_idstring––

No output schema declared.

No examples provided.

provider_country_risk ~48

Enrich provider dependencies with OECD economic risk: GDP, unemployment, CLI per provider country. DORA Art. 28-31 relevant.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

readiness_check ~56

Full DORA readiness score + Ampel per article. Returns GREEN/YELLOW/RED/GREY for all 26 articles, score 0-100, days until deadline.

NameTypeReqDescription
entity_idstring–Entity ID (optional)

No output schema declared.

No examples provided.

reg_watchdog ~68

AI Regulatory Watchdog: scrapes EBA/ESMA/BaFin/CERT-Bund for DORA updates. Returns alerts with affected articles and severity. Run daily via cron or on-demand.

NameTypeReqDescription
days_backinteger–Check items from last N days (default: 7)

No output schema declared.

No examples provided.

register_provider ~190

Register an ICT third-party provider for DORA Art. 28 Register of Information. Stores provider data and creates evidence.

NameTypeReqDescription
annual_cost_eurnumber––
certificationsstring––
contract_endstring––
contract_startstring––
criticalitystring–critical, important, standard
data_locationstring–Where data is stored e.g. EU (Frankfurt)
entity_idstring––
headquartersstring–Country e.g. Luxembourg, Germany
leistring–Legal Entity Identifier
provider_namestring–Provider name e.g. Amazon Web Services EMEA SARL
provider_typestring–cloud_infrastructure, saas_application, core_banking, cybersecurity, etc.
servicesstring–Services provided
substitutabilitystring––

No output schema declared.

No examples provided.

regulation_impact ~52

Show cross-regulation impacts for a specific DORA article. Maps DORA → MiCA + AMLR.

NameTypeReqDescription
dora_articlestring–DORA article ID (e.g. dora_art28)

No output schema declared.

No examples provided.

retest_finding ~45

Re-test a finding: collect fresh evidence, reassess check, auto-close if GREEN. Full closed-loop.

NameTypeReqDescription
finding_idstring–Finding ID to re-test

No output schema declared.

No examples provided.

run_escalation ~23

Trigger escalation engine: auto-create findings, check SLA, escalate.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

run_trial_assessment ~46

Run complete DORA+MiCA assessment for trial entity. Returns score, gaps, automation potential.

NameTypeReqDescription
entity_idstring––
trial_idstring––

No output schema declared.

No examples provided.

score_trend ~38

Score trend over time: weekly deltas, trajectory, peer benchmark. Shows improvement or decline.

NameTypeReqDescription
entity_idstring–Entity ID

No output schema declared.

No examples provided.

servicenow_sync ~56

ServiceNow incident + change management sync. DORA Art. 17/21 evidence. Returns 30-day incident stats, classification, resolution rates.

NameTypeReqDescription
days_backinteger–Days to look back (default 30)

No output schema declared.

No examples provided.

update_finding ~158

Update finding lifecycle: claim, set remediation plan, request re-test, close, or accept risk. Status flow: open -> in_progress -> retest_pending -> closed | risk_accepted.

NameTypeReqDescription
accepted_bystring–Name (for accept_risk)
actionstring–claim | plan | request_retest | close | accept_risk
actorstring–Who is performing this action
expiry_daysinteger–Risk acceptance expiry days (default 90)
finding_idstring–Finding ID
ownerstring–New owner (for claim)
reasonstring–Close reason (for close)
remediation_planstring–Remediation plan text (for plan)

No output schema declared.

No examples provided.

whatif_provider ~55

Simulate provider failure: which articles/checks are affected, score impact, risk level.

NameTypeReqDescription
entity_idstring–Entity ID
provider_namestring–Provider name (e.g. AWS, Finastra)

No output schema declared.

No examples provided.

whatif_stale ~59

Simulate stale evidence: what happens if a check stays stale for N days.

NameTypeReqDescription
check_idstring–Check ID
daysinteger–Days stale (default 30)
entity_idstring–Entity ID

No output schema declared.

No examples provided.

Install

How do I install the io.tooloracle/ampel MCP server?

io.tooloracle/ampel is a hosted endpoint at https://tooloracle.io/ampel/mcp/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · tooloracle.io

# add to Claude Code
claude mcp add --transport http io-tooloracle-ampel 'https://tooloracle.io/ampel/mcp/'
Common questions

What is the io.tooloracle/ampel MCP server?

io.tooloracle/ampel is an MCP server listed in the public MCP registry as io.tooloracle/ampel. AmpelOracle, 50-tool compliance traffic-light: Go/Caution/Stop signals for ESG, MiCA, AML. This page covers its hosted endpoint (https://tooloracle.io/ampel/mcp/).

Is the io.tooloracle/ampel MCP server safe to use?

io.tooloracle/ampel scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.tooloracle/ampel MCP server expose?

io.tooloracle/ampel exposes 50 tools: readiness_check, article_status, gap_report, evidence_summary, collect_art10, and 45 more. Their descriptions and schemas cost roughly 3,177 tokens of context every time the server is loaded.

Does the io.tooloracle/ampel MCP server require authentication?

No. We connected to io.tooloracle/ampel without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the io.tooloracle/ampel MCP server still maintained?

io.tooloracle/ampel is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.