Skip to main content
Glama

Ansvar: EU Compliance & Legal Intelligence

by eu.ansvar

Start Workflow

start_workflow

Begin a structured workflow selected from the live workflow registry. The registry covers threat and privacy modeling; enterprise, automotive, robot, rail, OT and UAS risk/TARA; DPIA and FRIA; regulatory, medical-device, drone and machinery gap analysis; tender review and audit; document review; SORA authorisation; vulnerability prioritisation; and deferral dossiers. Call list_workflow_types first: it is the authoritative source of exact ids, deliverables, required slots, variants, and availability for this caller. When a fresh registry snapshot is available, this tool's workflow_type input schema carries a caller-authorized enum; otherwise it remains a string rather than silently falling back to a stale catalog. The workflow engine guides the process step by step with quality gates. Each step's questions_for_user is advisory — answerable from context or uploaded documents; only steps returning requires_user_input=true carry the server-enforced human-input gate. Which types you can start is tier-fenced: free and solo include seven types (1 and 2 runs a month) — threat_model, gap_analysis with its gap_analysis_nis2, gap_analysis_dora, gap_analysis_cra and gap_analysis_ai_act variants, and dpia, each reported as JSON or as a watermarked html or pdf — at those tiers the framework argument accepts only nis2, dora, cra or eu_ai_act, and the base gap_analysis needs one of them; Premium adds the rest of the interview-grounded catalog — LINDDUN, the TARA families, FRIA and the jurisdictional DPIA and gap variants, SORA, the drone and OT types, machinery conformity, and enterprise risk — with 5 runs a month; document review, the tender family and adversary tabletop require Team or Company. A start SPENDS a run from the monthly allowance, and on free and solo a cancel does not hand an unused one back — name the workflow_type you intend to the user and get their OK before calling this, and check get_my_capabilities for what is left.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
frameworkNoRegulatory framework the run is scoped to, such as 'nis2', 'dora', 'cra', or 'eu_ai_act'. Free and solo accept only those four, and the base gap_analysis type requires one of them. Empty leaves the workflow's own default in place.
jurisdictionsNoISO-2 codes of the jurisdictions the assessment covers, such as ['SE', 'EU']. Empty leaves the workflow to ask for scope in a later step.
workflow_typeYesExact workflow type id from list_workflow_types, such as 'threat_model' or 'gap_analysis_nis2'. When a fresh registry snapshot is available this argument carries an enum of the ids this caller may start; otherwise call list_workflow_types rather than guessing an id from an example. Starting a workflow spends a run from the monthly allowance.
entity_descriptionNoPlain-language description of the organisation or system being assessed, used to ground the workflow's first steps — for example 'a Swedish payments SaaS processing card data for EU merchants'.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false; the description adds that starting 'SPENDS a run from the monthly allowance' and that cancellations don't refund on free/solo tiers. It also explains the dynamic enum behavior (caller-authorized vs string) and the server-enforced human-input gate. This is substantial behavioral context beyond the structured fields, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is comprehensive but dense, packed into one long paragraph with many conditional clauses. It is not broken into sections, and the critical call-list_workflow_types-first guidance is buried mid-paragraph. However, each sentence contributes necessary operational detail, which is justified given the tier and run allowance complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with tier fencings, run accounting, dynamic enums, and step-gate behavior, the description covers all required concepts: registry, variants, alternatives, quotas, and outputs (JSON or watermarked reports). An output schema exists to detail return values, so omission is acceptable. It gives the agent everything needed to decide when and how to call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds critical semantics: workflow_type is an exact id from list_workflow_types, not a guess, and the enum is caller-authorized with a stale-catalog caveat. It explains the framework argument's tier restriction to four values and the default behavior. Entity_description is described as grounding the first steps, adding to schema explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Begin a structured workflow selected from the live workflow registry,' clearly identifying a specific verb and resource. It distinguishes from sibling tools like list_workflow_types and cancel_workflow by focusing on starting, not listing or canceling. The registry coverage enumerates many workflow families, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs to 'Call list_workflow_types first' as the authoritative source for ids and availability, and to check get_my_capabilities and obtain user approval before spending a run. It explains tier restrictions and run consequences, giving clear when-to-use and pre-call steps. No explicit 'when not to use' but alternatives are implicitly covered through the referral to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Ansvar: EU Compliance & Legal Intelligence toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation4/5

Most tools have clearly distinct purposes, but a few pairs overlap: get_current_step vs get_progress, search_cve vs search_by_product, and describe_capabilities vs get_my_capabilities. The descriptions provide enough detail to differentiate them, but agents could still occasionally misselect.

Naming Consistency4/5

Names overwhelmingly follow a verb_noun snake_case pattern (get_*, list_*, search_*, start_*, etc.). Minor deviations like 'diff' and 'search' (single-word) and 'batch_search' (compound modifier) are predictable and don't disrupt the overall consistency.

Tool Count3/5

With 30 tools, the server is on the heavier side. The broad scope (legal intelligence, CVE data, full workflow engine) justifies many tools, but some are internal or niche (probe_corpus, recommend_subagents) and could be hidden. It's borderline between well-scoped and excessive.

Completeness4/5

The legal and CVE domains are well-covered: search, provision lookup, validation, diff, coverage, and detailed CVE enrichment. Workflow management is end-to-end. However, get_regulatory_deadlines is referenced by get_regulatory_intelligence_status but not exposed in the toolset, leaving a notable gap.

Resources