Moltline RegClock
Server Details
Incident-reporting deadlines from the law: CRA, NIS2, DORA, GDPR, HIPAA, SEC 8-K. 6 of 9 tools free.
- Status
- Healthy
- Uptime
- 100.0% over 62 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- Repository
- GarphenGate/moltline-mcp
- GitHub Stars
- 0
- Server Listing
- moltline-mcp
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 9 tools
Each tool has a clearly distinct role: classification, single-regime deadline computation, multi-regime merging, status polling, rule explanation, holiday lookup, regime listing, export, and draft validation. The one potentially overlapping pair, compute_deadlines and compute_deadlines_multi, is explicitly distinguished by scope and license tier. The descriptions also include clear 'not for' guidance that prevents misselection.
Most tool names follow a readable verb_noun pattern such as classify_event, compute_deadlines, explain_rule, list_regimes, and validate_report. A few deviate with noun_noun or noun_verb forms like deadline_status, holiday_calendar, and timeline_export, but the naming is still predictable and not chaotic. The deviations are minor rather than disruptive.
Nine tools is well within the appropriate range for a focused regulatory deadline engine. Each tool earns its place by covering a distinct part of the workflow, with no obvious filler or redundant entries. The free/premium split also does not add unnecessary surface area.
The surface covers the full practical lifecycle for this server's stated purpose: discovering regimes, classifying reportability, computing single and multi-regime deadlines, tracking status, explaining rules, checking holiday calendars, exporting timelines, and validating draft reports. There are no obvious dead ends for an agent working with incident reporting deadlines. Gaps such as actual report submission are outside the tool's apparent advisory/computational scope.
Available Tools
9 toolsclassify_eventClassify EventARead-onlyIdempotentInspect
Apply a regime's statutory criteria to yes/no facts and name the event type. FREE.
Typical input {"regime": "eu_dora", "facts": {"critical_services_affected": true, "duration_or_downtime": true, "geographic_spread": true}} returns {"reportable": true, "event_type": "major_ict_incident", "reasoning": [...], "criteria": {...}}. Unanswered questions are listed under "missing" so the caller can go and find out. Use when deciding whether an incident triggers a regime at all. Not for judging severity in the abstract: it only applies the written criteria to the facts given. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "facts must be an object of question id -> answer"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| facts | Yes | answers keyed by the question ids returned for the regime (booleans; integers for counts). | |
| regime | Yes | regime id from list_regimes. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state read-only, idempotent, non-destructive, and closed-world behavior, but the description adds substantial context beyond them: free usage, the response shape, missing-answer handling, and the fact that invalid input returns an error object rather than a protocol error. It also confirms that retrying after correcting input is safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first sentence, followed by a compact example, usage boundaries, and error behavior. Despite covering many details, every sentence adds practical information for invoking the tool correctly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool involves a nested facts object and regime identifier, and the description supplies an example, explains missing answers, and clarifies error behavior. An output schema exists, so the description need not document every return field, and it is complete enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline would be 3, but the description adds a concrete typical input example showing the nested facts object and the regime/facts relationship. The added example and the explanation of how unanswered questions surface as missing give useful meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: apply a regime's statutory criteria to facts and name the event type. It immediately distinguishes the tool's scope from severity judgment in the abstract, so an agent can tell what this tool is for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage guidance: use this when deciding whether an incident triggers a regime at all, and explicitly says it is not for judging severity in the abstract. It does not name specific sibling alternatives such as explain_rule or validate_report, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compute_deadlinesCompute DeadlinesARead-onlyIdempotentInspect
Compute every reporting deadline of one regime from the moment of awareness. FREE.
Typical input {"regime": "eu_nis2", "event_type": "significant_incident", "awareness_at": "2026-09-14T09:30:00+02:00"} returns {"deadlines": [{"obligation": "early_warning", "due_at": "2026-09-15T09:30+02:00", "citation": "Art. 23(4)(a)", ...}, ...]}. Later clocks that run from an earlier submission are estimated from that report's due time until you pass the actual time in submitted. DORA needs classification_at and a country for the bank-holiday rule; the SEC needs materiality_determined_at; HIPAA takes discovery_date and flags.individuals_affected. Use when an incident has just been identified and the agent needs the instants. Not for several regimes at once: use compute_deadlines_multi. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "flags must be an object"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | condition answers: high_risk, processor, ongoing, handled_at, individuals_affected, max_residents_of_one_state, business_associate. | |
| regime | Yes | regime id from list_regimes. | |
| subdiv | No | optional subdivision code for the holiday calendar (e.g. BY for Bavaria). | |
| country | No | ISO 3166-1 alpha-2 code for the public-holiday calendar (DORA weekend rule; SEC uses US). | |
| submitted | No | actual submission times of earlier reports, e.g. {"initial_notification": "..."}. | |
| event_type | No | event type within the regime; optional when the regime has one. | |
| awareness_at | Yes | when the entity became aware, ISO 8601 with a UTC offset. | |
| entity_class | No | e.g. trust_service_provider (NIS2), credit_institution / central_counterparty / trading_venue_operator / nis2_essential_or_important (DORA), business_associate (HIPAA). | |
| discovery_date | No | HIPAA - the date the breach is treated as discovered (defaults to awareness date). | |
| classification_at | No | DORA - when the incident was classified as major. | |
| measure_available_at | No | CRA - when a corrective or mitigating measure became available. | |
| materiality_determined_at | No | SEC - when the incident was determined to be material. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: it discloses the error contract ('never raises a protocol error; it returns {"error": ...}') with an example, states retry safety after correction, and warns that clocks running off an earlier submission are estimates until actual times are passed in 'submitted'. These are behavioral traits the readOnly/idempotent hints do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose, then a worked input/return example, then regime-specific parameter notes, then the exclusion and error contract. The return-value fragment partially duplicates the output schema, but the call shape is otherwise dense and waste-free.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return explanation is not required, and the description still supplies the error path, retry safety, and per-regime prerequisites. For a 12-parameter, nested-object tool this is enough to call correctly on the first attempt.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds genuine cross-parameter semantics the schema cannot express: which regime requires which extra parameter (DORA needs classification_at + country, SEC needs materiality_determined_at, HIPAA takes discovery_date and flags.individuals_affected) and how 'submitted' changes computed results. It leaves entity_class, subdiv, and measure_available_at to the schema, which lower-usage params can tolerate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Compute every reporting deadline of one regime from the moment of awareness') with explicit scope ('one regime'). It also names the sibling it is not for ('Not for several regimes at once: use compute_deadlines_multi'), so an agent can distinguish it without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete triggering condition ('when an incident has just been identified and the agent needs the instants'), an explicit exclusion, and the named alternative for the excluded case. Usage is fully determined, not inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compute_deadlines_multiCompute Deadlines MultiARead-onlyIdempotentInspect
One merged timeline across several regimes for the same incident. PREMIUM (license).
Typical input {"regimes": [{"regime": "eu_nis2"}, {"regime": "eu_gdpr"}, {"regime": "eu_dora", "entity_class": "credit_institution"}], "awareness_at": "2026-09-14T09:30:00+02:00", "country": "DE"} returns {"timeline": [rows sorted by due_at, each tagged with regime], "first_due": {...}, "per_regime": {...}}. Each entry may carry its own event_type and entity_class; the anchors and flags are shared. Use when one incident triggers several regimes and the agent needs a single ordered list. Not for one regime: compute_deadlines is free. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "regimes must be a non-empty list of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | condition answers shared by all regimes (see compute_deadlines). | |
| subdiv | No | optional subdivision code for the holiday calendar. | |
| country | No | ISO 3166-1 alpha-2 code for the public-holiday calendar. | |
| regimes | Yes | list of {"regime": id, "event_type"?: ..., "entity_class"?: ...} (1-10 entries). | |
| submitted | No | actual submission times keyed by "regime/obligation" or obligation id. | |
| awareness_at | Yes | when the entity became aware, ISO 8601 with a UTC offset. | |
| entity_class | No | default entity class for entries that do not set their own. | |
| discovery_date | No | HIPAA discovery date (defaults to the awareness date). | |
| classification_at | No | DORA classification instant. | |
| measure_available_at | No | CRA corrective-measure instant. | |
| materiality_determined_at | No | SEC materiality determination instant. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond the annotations: a non-throwing error contract with a concrete error payload example, the safety of retrying after correction, and a PREMIUM license cost signal. It does repeat read-only/idempotent from the annotations, but the error and licensing disclosures are the value-add.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the payoff, then example, then when-to-use, then error behavior. The inline JSON examples are dense but earn their space by showing the per-entry override pattern; a little trimming of formatting would help readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output shape is described (timeline sorted by due_at, first_due, per_regime) even though an output schema exists, and the failure mode is covered. The advanced anchor fields (classification_at, measure_available_at, materiality_determined_at) are only gestured at via 'anchors... shared', leaving their per-regime interaction to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description earns above that by explaining override semantics — each regime entry may carry its own event_type and entity_class while anchors and flags are shared across the call. That resolves how the 11 parameters compose, which the flat schema does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (merged timeline across several regimes for one incident) and immediately distinguishes itself from the single-regime sibling. The example makes the scope concrete: one incident, multiple regimes, one ordered list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit positive guidance ('Use when one incident triggers several regimes and the agent needs a single ordered list') plus an explicit negative with a named alternative ('Not for one regime: compute_deadlines is free'). No inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deadline_statusDeadline StatusARead-onlyIdempotentInspect
Mark each computed deadline open, due soon, overdue or submitted as of now. FREE.
Typical input {"deadlines": , "now": "2026-09-15T08:00:00+02:00"} returns {"items": [{"obligation": "early_warning", "status": "due_soon", "hours_remaining": 1.5, ...}], "overdue": 0, "next_due": {...}}. Use when polling an incident timeline or deciding what to escalate next. Not for computing the deadlines themselves. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| now | Yes | the current instant, ISO 8601 with a UTC offset. | |
| deadlines | Yes | rows from compute_deadlines / compute_deadlines_multi (each with obligation and due_at). | |
| submitted | No | actual submission times keyed by obligation id (or "regime/obligation"). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses a key error contract: invalid input does not raise a protocol error but returns an {"error": ...} object with remediation guidance. It also explains retry safety after correction and shows the return shape, which gives the agent actionable behavioral context beyond readOnlyHint, idempotentHint, and destructiveHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and logically structured: purpose, example input/output, usage context, exclusion, and error behavior. It is slightly overlong because 'FREE.' is unnecessary, the return example duplicates the output schema, and read-only/idempotent repeats the annotations, but the core content is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the annotations and the presence of an output schema, the description is complete enough to call the tool correctly. It covers purpose, intended use, exclusion, input example, error behavior, and retry safety, leaving only low-level details to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in the schema. The description adds a typical input example for deadlines and now, but it does not explain the optional submitted parameter or add meaning beyond the schema. This fits the baseline 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation and resource: it marks computed deadlines with one of several statuses as of a given instant. It also explicitly excludes computing the deadlines themselves, which distinguishes it from compute_deadlines and compute_deadlines_multi. An agent can understand what this tool does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states concrete usage contexts: polling an incident timeline or deciding what to escalate next. It also states the negative case, 'Not for computing the deadlines themselves,' and the input description points back to rows from compute_deadlines, effectively routing the agent to the right sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_ruleExplain RuleARead-onlyIdempotentInspect
Quote the time limit, citation and required content for an obligation. FREE.
Typical input {"regime": "eu_cra", "event_type": "severe_incident", "obligation": "final_report"} returns {"citation": "Art. 14(4)(c)", "rule": "within one month after ...", "required_content": [...]}. Leave obligation empty to get every obligation of the event type; leave event_type empty on single-event regimes. Use when a caller needs the rule's own words next to a computed date. Not for computing dates: use compute_deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "unknown obligation '' for /; one of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| regime | Yes | regime id from list_regimes (eu_cra, eu_nis2, eu_dora, eu_gdpr, uk_gdpr, us_hipaa, us_sec_8k). | |
| event_type | No | event type within the regime (see list_regimes); optional when the regime has one. | |
| obligation | No | obligation id (for example early_warning); empty for all. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly/idempotent/non-destructive), the description discloses two traits annotations cannot express: it is free, and it never raises a protocol error but instead returns {"error": "<what is wrong and how to fix it>"} with a concrete example. That error contract plus the retry-safety note is exactly the kind of behavioral context an agent needs and structured fields do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose and the free/read-only guarantee, then example, then usage, then error contract. It is dense and nearly every clause earns its place, but the inline multi-line JSON blobs make it visually heavier than necessary and slightly slow to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter, typed, single-object tool with an output schema, the description covers purpose, argument edge cases, sibling routing, cost, error semantics and retry safety. Nothing an agent needs in order to call it correctly is missing; return shape is even illustrated despite the output schema already documenting it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline would be 3, but the description adds value the schema lacks: a worked input example ({regime, event_type, obligation}) paired with the shape of the response, which clarifies how the three arguments compose. It stops short of enumerating valid regime/event_type/obligation values, deferring to list_regimes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Quote the time limit, citation and required content for an obligation.' It also draws the boundary against the sibling that shares the same domain ('Not for computing dates: use compute_deadlines'), so an agent can discriminate it from the deadline-computation tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit inclusion criterion ('when a caller needs the rule's own words next to a computed date'), an explicit exclusion with a named alternative (compute_deadlines), and edge-case guidance for empty arguments ('leave obligation empty to get every obligation…; leave event_type empty on single-event regimes').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
holiday_calendarHoliday CalendarARead-onlyIdempotentInspect
List the public holidays the engine uses for a country and year. FREE.
Typical input {"country": "IE", "year": 2026} returns {"holidays":
[{"date": "2026-01-01", "name": "New Year's Day"}, ...]}. Use when
checking why a business-day or bank-holiday adjustment landed where it
did, or to see whether a country/subdivision is supported. Not a legal
register of bank holidays: it is the holidays package's public-holiday
calendar, which is what compute_deadlines uses. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "country is required"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| year | Yes | calendar year. | |
| subdiv | No | optional subdivision code (state, province, region). | |
| country | Yes | ISO 3166-1 alpha-2 code (DE, FR, IE, US, ...). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (which already declare read-only, idempotent, non-destructive) by disclosing that invalid input never raises a protocol error but returns {"error": "<what is wrong and how to fix it>"}, and that retrying after correction is safe. It also flags the tool as FREE, which annotations do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose and the FREE marker, and each subsequent sentence (example, when-to-use, scope caveat, error contract) carries information. It is somewhat dense as one flowing block, and the example return value partly duplicates the output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter lookup tool it covers purpose, scope caveat, error behavior, retry safety, and usage triggers; the presence of an output schema means the return format needs no further explanation. Nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so country/year/subdiv semantics are already documented, and the description only adds a sample input ({"country": "IE", "year": 2026}). That example illustrates format but adds no constraint or meaning the schema lacks, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the public holidays the engine uses for a country and year') with explicit scope, and names its relationship to compute_deadlines, so an agent can separate it from sibling tools without opening a schema. The parenthetical naming of the underlying `holidays` package further pins down semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use triggers ('checking why a business-day adjustment landed where it did', 'see whether a country/subdivision is supported') plus an explicit when-not ('Not a legal register of bank holidays'). It stops short of naming the closest sibling (list_regimes) as the alternative for the country-support question it mentions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_regimesList RegimesARead-onlyIdempotentInspect
List the reporting regimes this server can compute, with citations. FREE.
Typical input {} returns {"regimes": [{"id": "eu_nis2", "name": ..., "instrument": ..., "applies_from": ..., "event_types": [...]}, ...], "verified_on": "2026-09-06"}. Use when choosing the regime id and event_type for compute_deadlines or classify_event. Not for legal advice: it reports what the instruments say and when the entry was last checked. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly, idempotent, closed-world), the description discloses cost ('FREE'), the non-protocol-error behavior ('never raises a protocol error; returns {"error": ...}'), recovery guidance, and the meaning of verified_on. These are precisely the traits an agent cannot infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded purpose and cost, then usage, then behavior notes — good ordering with no filler. The inline output sample is slightly redundant given an output schema exists, though it does make the regime object shape concrete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, cost, usage trigger, downstream consumers, error semantics, retry safety, and scope caveat. Nothing an agent needs in order to call a zero-parameter read tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The description still shows the canonical empty input {} and what the resulting object contains, which clarifies that no filtering or arguments are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the reporting regimes this server can compute, with citations') and immediately distinguishes itself from siblings by naming compute_deadlines and classify_event as the consumers of its output. An agent knows exactly what this returns and why it exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use when choosing the regime id and event_type for compute_deadlines or classify_event' gives an explicit trigger condition plus the downstream tools, which is the real selection logic for a discovery tool. The 'Not for legal advice' line sets the boundary of what the results may be used for.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
timeline_exportTimeline ExportARead-onlyIdempotentInspect
Export computed deadlines as an iCalendar file and CSV rows. PREMIUM (license).
Typical input {"deadlines": , "incident_ref": "INC-2026-041"} returns {"ics": "BEGIN:VCALENDAR...", "csv": "regime,obligation,...", "events": 4}. Each dated deadline becomes a VEVENT with the citation in the description and an alarm alarm_hours_before it; rows without a fixed time limit are listed in the CSV only. Use when the timeline needs to land in a calendar or a ticket. Not for computing deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| deadlines | Yes | rows from compute_deadlines / compute_deadlines_multi. | |
| incident_ref | No | your incident reference, prefixed to every event summary. | |
| calendar_name | No | X-WR-CALNAME for the calendar file. | Incident reporting deadlines |
| alarm_hours_before | No | hours before each due instant to fire a VALARM (0 disables). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, and the description adds genuinely new behavior: a PREMIUM license gate, per-row mapping rules (dated deadlines become VEVENTs with citation in description plus a VALARM; open-ended rows go to CSV only), and a documented error contract (returns {"error": ...} rather than a protocol error, safe to retry). That is well beyond what the structured fields convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then example input/output, then usage and error behavior – a sensible order with no filler sentences. The inline JSON snippets make it longer than strictly necessary, but each carries real information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter export tool with full schema coverage, an output schema, and explicit annotations, the description still covers the license constraint, input provenance, output shape, and failure/retry behavior. An agent has everything needed to call it correctly and recover from bad input.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline would be 3, but the description adds meaning the schema does not: what the deadlines rows actually contain and how they are split between VEVENTs and CSV, plus a concrete example input object. The alarm and incident_ref semantics largely duplicate schema text, keeping it below a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Export computed deadlines as an iCalendar file and CSV rows') and explicitly separates itself from compute_deadlines ('Not for computing deadlines'). An agent can distinguish it from all siblings including compute_deadlines_multi without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives the positive trigger ('Use when the timeline needs to land in a calendar or a ticket'), the negative case ('Not for computing deadlines'), and the upstream source of input (rows from compute_deadlines / compute_deadlines_multi). Nothing about when to select this tool is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_reportValidate ReportARead-onlyIdempotentInspect
Check a draft report against the statutory content list and its deadline. PREMIUM (license).
Typical input {"regime": "eu_gdpr", "obligation": "supervisory_authority_notification", "report": {"nature": "...", "contact": "...", "consequences": "...", "measures": "..."}} returns {"checklist": [{"item": "...", "found": true, "evidence": [...]}, ...], "missing": [...], "coverage": 0.75, "timing": {...}}. The content check is a keyword heuristic over the report text, reported as such; the timing check compares submitted_at with due_at and, for GDPR, flags a late notification that gives no reasons for the delay. Use before a report is sent. Not a legal review, and it cannot judge quality, only presence. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""} (for example {"error": "unknown obligation '' for /; one of "}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
| Name | Required | Description | Default |
|---|---|---|---|
| due_at | No | the computed due instant (from compute_deadlines), optional. | |
| regime | Yes | regime id from list_regimes. | |
| report | Yes | the draft, as an object of section name -> text (any keys). | |
| event_type | No | event type within the regime; optional when the regime has one. | |
| obligation | Yes | obligation id (for example incident_notification). | |
| submitted_at | No | when the report was or will be submitted, optional. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing that the content check is a keyword heuristic (not semantic), that GDPR timing flags late notifications lacking reasons, and that malformed input never raises a protocol error but returns a structured {error} object. The PREMIUM license constraint and the safe-retry statement add operational context annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose and the license constraint, then the examples, then the caveats and error contract. Dense but each block carries information; the inline JSON examples are worth their length, though the return-value narration is partly redundant with the output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with a nested free-form report object and an output schema, the description covers purpose, triggering moment, heuristic limits, error contract, and retry safety. An agent has everything needed to invoke it correctly and interpret failures.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description does add value with a concrete input example showing regime/obligation/report shape and an error example enumerating valid obligation ids, but it leaves event_type and the optional submitted_at/due_at defaults to the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: check a draft report against a statutory content list and its deadline. The word 'check' plus the 'presence not quality' boundary clearly separates it from compute_deadlines, deadline_status, and classify_event, which produce inputs or status rather than validating content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use before a report is sent' gives an explicit call point, and 'Not a legal review, and it cannot judge quality, only presence' rules out a misapplication. It does not explicitly route the agent to compute_deadlines for due_at or to list_regimes for regime ids, though the schema's parameter descriptions cover that handoff.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
- First observed
classify_event - First observed
compute_deadlines - First observed
compute_deadlines_multi - First observed
deadline_status - First observed
explain_rule - First observed
holiday_calendar - First observed
list_regimes - First observed
timeline_export - First observed
validate_report
Related MCP Connectors
Who to notify after a data breach and by what date: all US states, SEC, HIPAA, GDPR, UK. Sourced.
NIS2 tools: scope check, EU transposition, incident deadlines, and your own org's status (token).
Bulk breach notice deadline checks: US states, SEC, HIPAA, GDPR, UK, per check billing via Apify.
IncidentOracle - 12-tool incident management MCP: triage, BaFin DORA reporting, RCA.
Related MCP Servers
- AlicenseBqualityCmaintenanceMulti-regime AI incident classification and reporting MCP supporting EU AI Act Article 73, DORA, NIS2, and GDPR breach reporting.374 PyPIMIT
- AlicenseNot gradedqualityDmaintenanceBroadcasts Article 73 incident reports simultaneously to EU AI Act, DORA, NIS2, GDPR, and ISO 42001 regulators, with escalation workflows and audit trails.59 PyPIMIT
- FlicenseNot gradedqualityDmaintenanceEnables DORA-compliant ICT incident management through 12 MCP tools for logging, classifying, and reclassifying incidents, generating initial notifications and final reports, and tracking reporting deadlines. It supports major incident checks, incident dashboards, cyber threat notifications, and full incident register queries.-
- AlicenseNot gradedqualityDmaintenanceEnables users to calculate GDPR subject access request deadlines and 72-hour breach notification clocks, and to generate acknowledgement, extension and clarification letter templates for the UK, EU and Switzerland. It also provides breach reportability triage, DPIA and EU AI Act screening for AI tools, HR retention periods, DSAR search checklists and fixed-price outsourcing quotes.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.