# ClevSec EU compliance tools (remote · mcp.clevsec.one) Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act. - Trust score: 75/100 (medium) - Change this week: +3 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - remote · `mcp.clevsec.one`: 75/100 (this document), [markdown](https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp.md), [page](https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp) ## Channel facts - Endpoint: `https://mcp.clevsec.one/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.4.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Endpoint Security**: 74/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. - HTTPS is enforced; there's no plaintext access path. - HSTS check failed: the Strict-Transport-Security header is absent. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 59/100 - AI-judged instruction clarity (good). - Context-footprint check failed: tool/resource definitions use about 8310 tokens (~268/item across 31 items; 31 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 53/100 - Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 98/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 94% of tool parameters carry a description. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 31 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a current MCP spec version (2026-07-28). ## Install ### How do I install the ClevSec EU compliance tools MCP server? ClevSec EU compliance tools is a hosted endpoint at https://mcp.clevsec.one/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http one-clevsec-eu-compliance 'https://mcp.clevsec.one/mcp' ``` ### Cursor ```json { "mcpServers": { "one-clevsec-eu-compliance": { "url": "https://mcp.clevsec.one/mcp" } } } ``` ### VS Code ```json { "servers": { "one-clevsec-eu-compliance": { "type": "http", "url": "https://mcp.clevsec.one/mcp" } } } ``` ### Codex ```toml [mcp_servers.one-clevsec-eu-compliance] url = "https://mcp.clevsec.one/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "one-clevsec-eu-compliance": { "type": "remote", "url": "https://mcp.clevsec.one/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add one-clevsec-eu-compliance --url 'https://mcp.clevsec.one/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: one-clevsec-eu-compliance: url: "https://mcp.clevsec.one/mcp" ``` ### Netclaw ```json { "McpServers": { "one-clevsec-eu-compliance": { "Transport": "http", "Url": "https://mcp.clevsec.one/mcp" } } } ``` ### Vellum ```bash assistant mcp add one-clevsec-eu-compliance -t streamable-http -u 'https://mcp.clevsec.one/mcp' ``` ### Other ```json { "mcpServers": { "one-clevsec-eu-compliance": { "type": "http", "url": "https://mcp.clevsec.one/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-04 (score 75, +1) - [security] The server rewrote its instructions, which are the text every model session reads - [functional] Server version: 1.3.0 → 1.4.0 - [functional] New tool “mcp_tools_check” - [functional] New tool “mcp_tools_report” ### 2026-11-02 (score 74, +1) - [security] The server rewrote its instructions, which are the text every model session reads - [functional] Server version: 1.2.1 → 1.3.0 - [functional] New tool “agent_risk_check” ### 2026-10-31 (score 73, +1) No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-29 (score 72, +1) No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-26 (score 71, +1) No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-24 (score 70, +1) - [security] Tool “gdpr_checklist_assessment” rewrote its description, which is the text the model reads ### 2026-10-22 (score 69, +1) - [functional] Server version: 1.2.0 → 1.2.1 ### 2026-10-21 (score 68, 0) - [functional improvement] Stability: unverified → 0.03 ## MCP tools (31) ### `reporting_deadlines` (~119 tokens) EU incident and breach reporting deadlines Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts. Input parameters: - `regimes` (array): Limit to these regimes; omit for all ### `nis2_scope_check` (~313 tokens) Does NIS2 apply, and is the entity essential or important? Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide. Input parameters: - `annual_turnover_eur` (number) - `balance_sheet_total_eur` (number) - `critical_entity_under_cer` (boolean): Identified as a critical entity under Directive (EU) 2022/2557 - `designated_by_member_state` (boolean): Identified by the member state under Art. 2(2)(b)-(e) - `national_security_or_law_enforcement` (boolean): Public administration working in national security, public security, defence or law enforcement (Art. 2(7)) - `provider_type` (string): Special provider types covered regardless of size (Art. 2(2)(a), 2(4)) - `public_administration` (string) - `sector` (string): The Annex I or II sector of the entity's activity; omit if none applies - `staff_headcount` (number, required): Staff in annual work units, including partner and linked enterprises ### `nis2_gap_assessment` (~156 tokens) NIS2 readiness gap assessment Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps. Input parameters: - `answers` (object): Question id to answer, e.g. {"g1": "yes", "r2": "partial"}. Omit to get the questions. Unanswered questions count as gaps. ### `dora_classify_incident` (~507 tokens) DORA major ICT-related incident check Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know. Input parameters: - `affected_clients_count` (integer) - `affected_clients_percent` (number): Affected clients as % of all clients using the affected service - `affected_counterparts_percent` (number): Affected financial counterparts as % of those active in the affected service - `affected_transactions_number_percent` (number): Affected transactions as % of the daily average number for the service - `affected_transactions_value_percent` (number): Affected transaction amount as % of the daily average value for the service - `affects_authorised_or_supervised_services` (boolean): Financial services requiring authorisation or registration, or supervised, are affected (Art. 6(b)) - `affects_critical_or_important_functions` (boolean): ICT services or systems supporting critical or important functions are affected (Art. 6(a)) - `costs_and_losses_eur` (number): Direct and indirect costs and losses per Art. 7, without financial recoveries - `critical_service_downtime_hours` (number): Downtime of ICT services supporting critical or important functions - `data_impact_adverse` (boolean): Impact on availability, authenticity, integrity or confidentiality of data that harms business objectives or regulatory compliance (Art. 9(5)(a)) - `duration_hours` (number) - `member_states_with_impact` (integer) - `relevant_clients_or_counterparts_affected` (boolean): Clients or counterparts identified as relevant under Art. 1(3) are affected - `reputational_impact` (boolean): Media coverage, repetitive complaints, likely failure to meet regulatory requirements, or likely loss of clients with material impact (Art. 2) - `successful_malicious_unauthorised_access` (boolean): A successful, malicious and unauthorised access to network and information systems occurred that may result in data losses (Arts. 6(c), 9(5)(b)) ### `dora_checklist` (~141 tokens) DORA requirements checklist Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16. Input parameters: - `microenterprise` (boolean): The financial entity is a microenterprise (DORA Art. 3(60)) - `simplified_framework` (boolean): The entity is listed in DORA Art. 16(1) and uses the simplified framework ### `dora_gap_assessment` (~136 tokens) DORA readiness gap assessment Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, incident management, resilience testing, ICT third-party risk, information sharing), each with its DORA article. Call with answers (yes, partial, no per question id) to get a score per pillar, an overall readiness level and the gaps. Input parameters: - `answers` (object): Question id to answer, e.g. {"p1_1": "yes", "p2_3": "partial"}. Unanswered questions count as gaps. ### `gdpr_breach_decision` (~286 tokens) GDPR data breach: who must be notified? Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high. Input parameters: - `data_unintelligible` (boolean): The affected data were unintelligible to unauthorised people, e.g. state-of-the-art encryption with the key not compromised - `hours_since_aware` (number): Hours since the controller had a reasonable degree of certainty that a breach occurred - `individual_contact_disproportionate` (boolean): Contacting each person would involve disproportionate effort, e.g. no contact details - `risk` (string, required): Likely risk to people's rights and freedoms (EDPB Guidelines 9/2022): consider the type of breach, the sensitivity and volume of the data, how easily people can be identified, how severe the conseque… - `role` (string): Controller decides why and how data are processed; a processor acts on its behalf - `subsequent_measures_remove_high_risk` (boolean): Measures taken since then ensure the high risk is no longer likely to materialise ### `gdpr_fine_estimate` (~337 tokens) GDPR fine starting range (EDPB method) Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine. Input parameters: - `annual_turnover_eur` (number, required): Total worldwide annual turnover of the undertaking in the preceding financial year, in EUR - `damage` (string) - `data_categories` (array): basic contact data, financial, other personal (e.g. location), special categories (Art. 9), children's data, criminal data (Art. 10) - `duration` (string): short: under a month; medium: 1 to 12 months; long: over a year - `fault` (string): low: measures in place but one failed; clear: a known risk not addressed; intent: intentional or against advice - `infringement_tier` (string, required): 83(4): controller/processor obligations such as security (Art. 32) and breach notification (Arts. 33-34). 83(5): principles, legal basis, data subject rights, transfers - `people_affected` (integer) - `seriousness` (string): Seriousness per EDPB Guidelines 04/2022 para. 60; omit to have it suggested from the facts below ### `gdpr_checklist_assessment` (~136 tokens) GDPR compliance checklist Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 areas (lawfulness, transparency and rights, minimisation and retention, security, breaches, processors, accountability, international transfers), each with its article. Call with the ids done (and optional items not applicable) to get the completion score and the open items. Input parameters: - `done` (array): Ids of the items already in place - `not_applicable` (array): Ids of optional items that do not apply (only items marked optional) ### `gdpr_dpia_screening` (~1109 tokens) GDPR DPIA screening and risk summary Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is. Applies GDPR Art. 35(3), national lists and the nine WP248 rev.01 criteria, scores necessity and mitigation, and gives an indicative residual risk. Call without input to get the questions; every input is optional. Input parameters: - `c1` (string): Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)? - `c2` (string): Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)? - `c3` (string): Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)? - `c4` (string): Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)? - `c5` (string): Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)? - `c6` (string): Does it combine or match datasets from different sources in ways people would not expect? - `c7` (string): Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)? - `c8` (string): Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)? - `c9` (string): Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)? - `m1` (string): Encryption of personal data at rest and in transit - `m10` (string): Data Processing Agreements with all third-party processors - `m11` (string): Privacy by design principles applied in system architecture - `m12` (string): Mechanism for data subjects to exercise their rights easily - `m2` (string): Pseudonymization or anonymization where possible - `m3` (string): Access controls limiting who can view/modify the data - `m4` (string): Regular security testing (vulnerability scans, penetration tests) - `m5` (string): Staff training on data protection for those handling the data - `m6` (string): Data minimization — collecting only what is strictly necessary - `m7` (string): Automated deletion at end of retention period - `m8` (string): Incident response plan covering this processing activity - `m9` (string): Regular audits or reviews of the processing activity - `nec1` (string): Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data? - `nec2` (string): Is the amount of data collected proportionate to the purpose? - `nec3` (string): Is the retention period limited to what is necessary? - `nec4` (string): Are data subjects adequately informed about the processing (transparency)? - `nec5` (string): Can data subjects exercise their rights (access, rectification, erasure, portability)? - `nec6` (string): If relying on consent, is it freely given, specific, informed, and withdrawable? - `nec7` (string): If relying on legitimate interest, has a balancing test been conducted? - `proj_data` (array): Categories of personal data - `proj_legal` (string): Legal basis for processing - `proj_subjects` (array): Categories of data subjects - `r1` (string): Risk of unauthorized access to personal data (data breach) - `r10` (string): Risk of loss of confidentiality (e.g. medical or legal privilege) - `r2` (string): Risk of data being used for purposes beyond what was communicated - `r3` (string): Risk of inaccurate data leading to wrong decisions about individuals - `r4` (string): Risk of excessive data collection beyond what is needed - `r5` (string): Risk of insufficient transparency — individuals unaware of processing - `r6` (string): Risk of discrimination or unfair treatment based on the processing - `r7` (string): Risk of financial loss or economic disadvantage to individuals - `r8` (string): Risk of reputational damage or social disadvantage to individuals - `r9` (string): Risk of physical harm or safety concerns - `t1` (string): Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them? - `t2` (string): Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal convicti… - `t3` (string): Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)? - `t4` (string): Is this type of processing on your supervisory authority's published list of operations that require a DPIA? - `x1` (string): Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)? ### `privacy_notice_requirements` (~188 tokens) GDPR privacy notice: what it must contain Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need. Input parameters: - `automated_decisions` (boolean): Solely automated decisions with legal or similarly significant effects, including profiling (Art. 22) - `has_dpo` (boolean): A data protection officer is appointed - `relies_on_consent` (boolean) - `relies_on_legitimate_interests` (boolean) - `source` (string): data_subject: collected from the person (forms, accounts, cookies); other_source: from third parties, public sources or data brokers - `transfers_outside_eea` (boolean) ### `data_flow_record_check` (~87 tokens) GDPR data flow and Art. 30 record check Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recipients, legal basis, retention, transfers); returns, per flow, what an Art. 30 record still lacks, plus the allowed values for categories, legal bases and safeguards. Input parameters: - `flows` (array, required) ### `cookie_consent_check` (~114 tokens) Cookie consent compliance check Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to get the checklist items by area, critical ones marked. Call with yes, partial or no per item to get a score, a compliance label and the open items. Input parameters: - `answers` (object): Item id to answer, e.g. {"c1": "yes", "c3": "partial"}. Unanswered items count as gaps. ### `cra_reporting_check` (~328 tokens) Cyber Resilience Act: must the manufacturer report? Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users. Input parameters: - `affects_data_or_functions_protection` (boolean): Severe incident test, Art. 14(5)(a): it harms or can harm the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions - `event` (string, required): actively_exploited_vulnerability: reliable evidence that a malicious actor exploited it; severe_incident: an incident affecting the product's security - `is_manufacturer` (boolean): Develops or manufactures the product, or has it designed or made, and markets it under its own name or trademark - `malicious_code` (boolean): Severe incident test, Art. 14(5)(b): it led or can lead to malicious code in the product or in users' systems - `product_with_digital_elements` (boolean): Software or hardware product (and its remote data processing) made available in the EU whose intended or foreseeable use includes a data connection to a device or network (Arts. 2(1), 3(1)); some pro… ### `iso27001_gap_assessment` (~137 tokens) ISO 27001 readiness gap assessment Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 control checks in four themes (organizational, people, physical, technological) with their Annex A references. Call with a status per control (implemented, partial, planned, not_impl) to get a score per theme, a readiness level and the gaps. Input parameters: - `answers` (object): Control question id to status, e.g. {"o1": "implemented", "t3": "planned"}. Unanswered controls count as gaps. ### `vendor_risk_assessment` (~630 tokens) Vendor security risk assessment Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or DORA). Call without input to get the questions. Call with the vendor profile (type, criticality, data access, regimes) and answers (yes, partial, no, unknown) to get a risk score, risk level, monitoring tier and the gaps. Input parameters: - `bcp1` (string): Does the vendor have a business continuity / disaster recovery plan? - `bcp2` (string): Does the vendor offer a defined SLA with uptime guarantees? - `bcp3` (string): Can data be exported/migrated if you terminate the relationship? - `bcp4` (string): Does the vendor have geographic redundancy for critical services? - `bcp5` (string): Is the vendor financially stable (no signs of distress)? - `com1` (string): Is the vendor compliant with GDPR (if processing EU personal data)? - `com2` (string): Will the vendor sign a Data Processing Agreement? - `com3` (string): Does the vendor provide right-to-audit or access to audit reports? - `com4` (string): Does the vendor's contract include security requirements and SLAs? - `com5` (string): Does the vendor have adequate insurance coverage (cyber liability)? - `criticality` (string): How critical is this vendor to your operations? - `dataAccess` (array): What data will this vendor access? - `inc1` (string): Does the vendor have a documented incident response plan? - `inc2` (string): Will the vendor notify you of security incidents within 24-48 hours? - `inc3` (string): Has the vendor experienced any data breaches in the last 3 years? - `inc4` (string): Does the vendor conduct incident response exercises/tabletop tests? - `regimes` (array): Which of these apply to your organization? (optional) - `sec1` (string): Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? - `sec2` (string): Does the vendor have a documented information security policy? - `sec3` (string): Does the vendor encrypt data at rest and in transit? - `sec4` (string): Does the vendor enforce multi-factor authentication? - `sec5` (string): Does the vendor conduct regular penetration testing? - `sec6` (string): Does the vendor have a vulnerability management program? - `sec7` (string): Does the vendor perform background checks on employees with data access? - `sup1` (string): Does the vendor disclose its key subprocessors/subcontractors? - `sup2` (string): Will the vendor notify you before changing subprocessors? - `sup3` (string): Does the vendor assess the security of its own suppliers? - `sup4` (string): Are subprocessor contracts held to the same security standards? - `vendorType` (string): Type of service ### `maturity_assessment` (~113 tokens) Cybersecurity maturity assessment (NIST CSF 2.0) Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF functions and the 1-5 levels. Call with a level per capability to get the average per function and an overall maturity level. Input parameters: - `answers` (object): Question id to maturity level 1-5, e.g. {"gv1": 2, "id1": 3}. Unanswered questions count as level 1. ### `cyber_risk_score` (~122 tokens) Cyber risk score (15 key controls) Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted questions on access, data, systems, people, incident response and backups. Call with yes, partial or no per question to get a 0-100 score, a risk level and a score per category. Input parameters: - `answers` (object): Question id to answer, e.g. {"q1": "yes", "q4": "partial"}. Unanswered questions score zero. ### `agent_risk_check` (~225 tokens) AI agent risk check (exposure and controls) Use when someone asks how risky an AI agent or assistant setup is ('is it safe to let our agent read email and send replies?', 'what are the risks of this agent?'). Call without answers to get 9 questions on what the agent can do and 11 on the controls that limit it. Call with answers to get a 0-100 residual risk score (0 = lowest), a risk level, red flags such as an exfiltration path, and the missing controls with actions and OWASP, GDPR and AI Act references. A self-assessment from the user's answers, not a scan or test of the agent. Input parameters: - `answers` (object): Question id to answer. Exposure questions e1-e9: "yes" or "no". Control questions c1-c11: "yes", "partial" or "no". Example: {"e1": "yes", "e2": "yes", "e3": "yes", "c2": "no"}. Unanswered exposure q… ### `mcp_tools_check` (~189 tokens) MCP tool list and A2A Agent Card check Use before enabling an MCP server or connecting to an A2A agent ('is this MCP server safe to add?', 'check these tool descriptions'). Pass the server's tools/list response or the agent's Agent Card as document. Returns flags for hidden or manipulative text in descriptions (tool poisoning), risky capabilities (running code, sending data out, an exfiltration path), annotations that do not match, secrets in parameters and missing Agent Card security fields, with a level per tool and a SHA-256 fingerprint to detect later changes. Reads declared metadata only; it does not connect to the server. Input parameters: - `document` (required): The JSON to check: a tools/list response (JSON-RPC response, its result, or the tools array) or an A2A Agent Card. - `public` (boolean): A2A only: true if the agent is deliberately public (no authentication by design). ### `nis2_remediation_plan` (~122 tokens) NIS2 remediation plan (ClevSec Pro) Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, the NIS2 article and a 30/60/90-day roadmap (governance, risk and incident gaps first). Requires ClevSec Pro. Input parameters: - `answers` (object, required): Question id to answer, e.g. {"g1": "yes", "r2": "partial"}. Omit to get the questions. Unanswered questions count as gaps. ### `dora_remediation_plan` (~115 tokens) DORA remediation plan (ClevSec Pro) Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, the DORA article and a 30/60/90-day roadmap (ICT risk management and incident management first). Requires ClevSec Pro. Input parameters: - `answers` (object, required): Question id to answer, e.g. {"p1_1": "yes", "p2_3": "partial"}. Unanswered questions count as gaps. ### `gdpr_remediation_plan` (~117 tokens) GDPR remediation plan (ClevSec Pro) Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a priority, the GDPR article and a 30/60/90-day roadmap (lawfulness, records, breach handling and processor contracts first). Requires ClevSec Pro. Input parameters: - `done` (array): Ids of the items already in place - `not_applicable` (array): Ids of optional items that do not apply (only items marked optional) ### `gdpr_dpia_report` (~1112 tokens) GDPR DPIA report and action plan (ClevSec Pro) Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indicative residual risk, and every gap (legal basis, special category data, necessity, missing measures, transfers, prior consultation under Art. 36) with an action, priority, article and a 30/60/90-day roadmap. Requires ClevSec Pro. Input parameters: - `c1` (string): Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)? - `c2` (string): Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)? - `c3` (string): Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)? - `c4` (string): Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)? - `c5` (string): Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)? - `c6` (string): Does it combine or match datasets from different sources in ways people would not expect? - `c7` (string): Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)? - `c8` (string): Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)? - `c9` (string): Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)? - `m1` (string): Encryption of personal data at rest and in transit - `m10` (string): Data Processing Agreements with all third-party processors - `m11` (string): Privacy by design principles applied in system architecture - `m12` (string): Mechanism for data subjects to exercise their rights easily - `m2` (string): Pseudonymization or anonymization where possible - `m3` (string): Access controls limiting who can view/modify the data - `m4` (string): Regular security testing (vulnerability scans, penetration tests) - `m5` (string): Staff training on data protection for those handling the data - `m6` (string): Data minimization — collecting only what is strictly necessary - `m7` (string): Automated deletion at end of retention period - `m8` (string): Incident response plan covering this processing activity - `m9` (string): Regular audits or reviews of the processing activity - `nec1` (string): Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data? - `nec2` (string): Is the amount of data collected proportionate to the purpose? - `nec3` (string): Is the retention period limited to what is necessary? - `nec4` (string): Are data subjects adequately informed about the processing (transparency)? - `nec5` (string): Can data subjects exercise their rights (access, rectification, erasure, portability)? - `nec6` (string): If relying on consent, is it freely given, specific, informed, and withdrawable? - `nec7` (string): If relying on legitimate interest, has a balancing test been conducted? - `proj_data` (array): Categories of personal data - `proj_legal` (string): Legal basis for processing - `proj_subjects` (array): Categories of data subjects - `r1` (string): Risk of unauthorized access to personal data (data breach) - `r10` (string): Risk of loss of confidentiality (e.g. medical or legal privilege) - `r2` (string): Risk of data being used for purposes beyond what was communicated - `r3` (string): Risk of inaccurate data leading to wrong decisions about individuals - `r4` (string): Risk of excessive data collection beyond what is needed - `r5` (string): Risk of insufficient transparency — individuals unaware of processing - `r6` (string): Risk of discrimination or unfair treatment based on the processing - `r7` (string): Risk of financial loss or economic disadvantage to individuals - `r8` (string): Risk of reputational damage or social disadvantage to individuals - `r9` (string): Risk of physical harm or safety concerns - `t1` (string): Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them? - `t2` (string): Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal convicti… - `t3` (string): Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)? - `t4` (string): Is this type of processing on your supervisory authority's published list of operations that require a DPIA? - `x1` (string): Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)? ### `data_flow_review` (~84 tokens) GDPR data flow compliance review (ClevSec Pro) Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate interest records, retention, international transfer tools and transfer impact assessments, and DPIA need, with an action, GDPR article and 30/60/90-day roadmap. Requires ClevSec Pro. Input parameters: - `flows` (array, required) ### `cookie_consent_fix_plan` (~107 tokens) Cookie consent fix plan (ClevSec Pro) Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Planet49, EDPB) and a 30/60/90-day roadmap. Requires ClevSec Pro. Input parameters: - `answers` (object, required): Item id to answer, e.g. {"c1": "yes", "c3": "partial"}. Unanswered items count as gaps. ### `iso27001_remediation_plan` (~113 tokens) ISO 27001 remediation plan (ClevSec Pro) Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended action, a priority, the Annex A control and a 30/60/90-day roadmap (organizational controls first). Requires ClevSec Pro. Input parameters: - `answers` (object, required): Control question id to status, e.g. {"o1": "implemented", "t3": "planned"}. Unanswered controls count as gaps. ### `vendor_due_diligence_plan` (~633 tokens) Vendor due diligence plan and contract clauses (ClevSec Pro) Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 27001 / GDPR / NIS2 / DORA references and a roadmap (before signing first), plus the contract clauses to include (GDPR Art. 28, NIS2 Art. 21, DORA Art. 30 when they apply). Requires ClevSec Pro. Input parameters: - `bcp1` (string): Does the vendor have a business continuity / disaster recovery plan? - `bcp2` (string): Does the vendor offer a defined SLA with uptime guarantees? - `bcp3` (string): Can data be exported/migrated if you terminate the relationship? - `bcp4` (string): Does the vendor have geographic redundancy for critical services? - `bcp5` (string): Is the vendor financially stable (no signs of distress)? - `com1` (string): Is the vendor compliant with GDPR (if processing EU personal data)? - `com2` (string): Will the vendor sign a Data Processing Agreement? - `com3` (string): Does the vendor provide right-to-audit or access to audit reports? - `com4` (string): Does the vendor's contract include security requirements and SLAs? - `com5` (string): Does the vendor have adequate insurance coverage (cyber liability)? - `criticality` (string): How critical is this vendor to your operations? - `dataAccess` (array): What data will this vendor access? - `inc1` (string): Does the vendor have a documented incident response plan? - `inc2` (string): Will the vendor notify you of security incidents within 24-48 hours? - `inc3` (string): Has the vendor experienced any data breaches in the last 3 years? - `inc4` (string): Does the vendor conduct incident response exercises/tabletop tests? - `regimes` (array): Which of these apply to your organization? (optional) - `sec1` (string): Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? - `sec2` (string): Does the vendor have a documented information security policy? - `sec3` (string): Does the vendor encrypt data at rest and in transit? - `sec4` (string): Does the vendor enforce multi-factor authentication? - `sec5` (string): Does the vendor conduct regular penetration testing? - `sec6` (string): Does the vendor have a vulnerability management program? - `sec7` (string): Does the vendor perform background checks on employees with data access? - `sup1` (string): Does the vendor disclose its key subprocessors/subcontractors? - `sup2` (string): Will the vendor notify you before changing subprocessors? - `sup3` (string): Does the vendor assess the security of its own suppliers? - `sup4` (string): Are subprocessor contracts held to the same security standards? - `vendorType` (string): Type of service ### `maturity_improvement_plan` (~130 tokens) Cybersecurity maturity improvement plan (ClevSec Pro) Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF 2.0 subcategory, NIS2 article and a 30/60/90-day roadmap (govern and identify first). Requires ClevSec Pro. Input parameters: - `answers` (object, required): Question id to maturity level 1-5, e.g. {"gv1": 2, "id1": 3}. Unanswered questions count as level 1. - `target_level` (integer) ### `cyber_risk_action_plan` (~116 tokens) Cyber risk action plan (ClevSec Pro) Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references and a 30/60/90-day roadmap (MFA, encryption, patching, incident response and backups first). Requires ClevSec Pro. Input parameters: - `answers` (object, required): Question id to answer, e.g. {"q1": "yes", "q4": "partial"}. Unanswered questions score zero. ### `mcp_tools_report` (~168 tokens) MCP tool list and Agent Card report (ClevSec Pro) Use after mcp_tools_check when the user wants a review report or to see what changed since approval. Pass document (current tools/list response or Agent Card) and optionally previous (the approved version). Returns every flag with an action, a priority, OWASP and MCP Security Audit Kit references, a change comparison (added, removed and changed tools with the changed fields) and an inventory row. Requires ClevSec Pro. Input parameters: - `document` (required): The JSON to check: a tools/list response (JSON-RPC response, its result, or the tools array) or an A2A Agent Card. - `previous`: Optional: the previously approved version, to compare. - `public` (boolean): A2A only: true if the agent is deliberately public (no authentication by design). ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp#diagnostics ## Score history - 2026-11-05: 75 - 2026-11-04: 75 - 2026-11-03: 74 - 2026-11-02: 74 - 2026-11-01: 73 - 2026-10-31: 73 - 2026-10-30: 72 - 2026-10-29: 72 - 2026-10-28: 71 - 2026-10-27: 71 - 2026-10-26: 71 - 2026-10-25: 70 - 2026-10-24: 70 - 2026-10-23: 69 - 2026-10-22: 69 - 2026-10-21: 68 - 2026-10-20: 68 ## Common questions ### What is the ClevSec EU compliance tools MCP server? ClevSec EU compliance tools is an MCP server listed in the public MCP registry as one.clevsec/eu-compliance. Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act. This page covers its hosted endpoint (https://mcp.clevsec.one/mcp). ### Is the ClevSec EU compliance tools MCP server safe to use? ClevSec EU compliance tools scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the ClevSec EU compliance tools MCP server expose? ClevSec EU compliance tools exposes 31 tools: reporting_deadlines, nis2_scope_check, nis2_gap_assessment, dora_classify_incident, dora_checklist, and 26 more. Their descriptions and schemas cost roughly 8,190 tokens of context every time the server is loaded. ### Does the ClevSec EU compliance tools MCP server require authentication? No. We connected to ClevSec EU compliance tools without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the ClevSec EU compliance tools MCP server still maintained? ClevSec EU compliance tools is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What did VerifyMCP test on the ClevSec EU compliance tools MCP server? VerifyMCP ran 13 checks on ClevSec EU compliance tools, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out. ## Links - Remote endpoint: https://mcp.clevsec.one/mcp - Website: https://clevsec.one/mcp/ - Changelog RSS feed: https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp/changelog.json - Trust report (JSON): https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp.json - HTML version of this page: https://verifymcp.io/servers/one-clevsec-eu-compliance/mcp