Skip to main content
Glama

Ansvar: EU Compliance & Legal Intelligence

by eu.ansvar
OverviewDiscussionsAdmin

Start Workflow

start_workflow

Begin a structured workflow selected from the live workflow registry. The registry covers threat and privacy modeling; enterprise, automotive, robot, rail, OT and UAS risk/TARA; DPIA and FRIA; regulatory, medical-device, drone and machinery gap analysis; tender review and audit; document review; SORA authorisation; vulnerability prioritisation; and deferral dossiers. Call list_workflow_types first: it is the authoritative source of exact ids, deliverables, required slots, variants, and availability for this caller. When a fresh registry snapshot is available, this tool's workflow_type input schema carries a caller-authorized enum; otherwise it remains a string rather than silently falling back to a stale catalog. The workflow engine guides the process step by step with quality gates. Each step's questions_for_user is advisory — answerable from context or uploaded documents; only steps returning requires_user_input=true carry the server-enforced human-input gate. Which types you can start is tier-fenced: free and solo include seven types (1 and 2 runs a month) — threat_model, gap_analysis with its gap_analysis_nis2, gap_analysis_dora, gap_analysis_cra and gap_analysis_ai_act variants, and dpia, each reported as JSON or as a watermarked html or pdf — at those tiers the framework argument accepts only nis2, dora, cra or eu_ai_act, and the base gap_analysis needs one of them; Premium adds the rest of the interview-grounded catalog — LINDDUN, the TARA families, FRIA and the jurisdictional DPIA and gap variants, SORA, the drone and OT types, machinery conformity, and enterprise risk — with 5 runs a month; document review, the tender family and adversary tabletop and the DORA ICT-contract and register-of-information variants require Team or Company. MiCA CASP and AMLR readiness are Premium workflows. A start SPENDS a run from the monthly allowance, and on free and solo a cancel does not hand an unused one back — name the workflow_type you intend to the user and get their OK before calling this, and check get_my_capabilities for what is left.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
frameworkNoRegulatory framework the run is scoped to, such as 'nis2', 'dora', 'cra', or 'eu_ai_act'. Free and solo accept only those four, and the base gap_analysis type requires one of them. Empty leaves the workflow's own default in place.
jurisdictionsNoISO-2 codes of the jurisdictions the assessment covers, such as ['SE', 'EU']. Empty leaves the workflow to ask for scope in a later step.
parent_run_idNosupplier_assurance_review only: the workflow_id of a completed run of the same type in your organisation that this run follows, for example after new evidence arrives once a decision is recorded. The parent run and its report are never changed. Empty starts an ordinary run.
workflow_typeYesExact workflow type id from list_workflow_types, such as 'threat_model' or 'gap_analysis_nis2'. When a fresh registry snapshot is available this argument carries an enum of the ids this caller may start; otherwise call list_workflow_types rather than guessing an id from an example. Starting a workflow spends a run from the monthly allowance.
succession_reasonNoRequired with parent_run_id: why this run follows its parent, for example 'new SOC 2 report after the decision'.
entity_descriptionNoPlain-language description of the organisation or system being assessed, used to ground the workflow's first steps — for example 'a Swedish payments SaaS processing card data for EU merchants'.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • addedInput schema / properties / parent_run_id
      Added value: +{
+  "default": "",
+  "description": "supplier_assurance_review only: the workflow_id of a completed run of the same type in your organisation that this run follows, for example after new evidence arrives once a decision is recorded. The parent run and its report are never changed. Empty starts an ordinary run.",
+  "title": "Parent Run Id",
+  "type": "string"
+}
    • addedInput schema / properties / succession_reason
      Added value: +{
+  "default": "",
+  "description": "Required with parent_run_id: why this run follows its parent, for example 'new SOC 2 report after the decision'.",
+  "title": "Succession Reason",
+  "type": "string"
+}
  2. Changed4 schema fields changed
    • addedInput schema / properties / entity_description / description
      Added value: +"Plain-language description of the organisation or system being assessed, used to ground the workflow's first steps — for example 'a Swedish payments SaaS processing card data for EU merchants'."
    • addedInput schema / properties / framework / description
      Added value: +"Regulatory framework the run is scoped to, such as 'nis2', 'dora', 'cra', or 'eu_ai_act'. Free and solo accept only those four, and the base gap_analysis type requires one of them. Empty leaves the workflow's own default in place."
    • addedInput schema / properties / jurisdictions / description
      Added value: +"ISO-2 codes of the jurisdictions the assessment covers, such as ['SE', 'EU']. Empty leaves the workflow to ask for scope in a later step."
    • addedInput schema / properties / workflow_type / description
      Added value: +"Exact workflow type id from list_workflow_types, such as 'threat_model' or 'gap_analysis_nis2'. When a fresh registry snapshot is available this argument carries an enum of the ids this caller may start; otherwise call list_workflow_types rather than guessing an id from an example. Starting a workflow spends a run from the monthly allowance."
  3. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and non-destructive; the description adds substantial context beyond that — run allowance spend semantics, no-refund on cancel at free/solo, the quality-gate behavior, the requires_user_input gate distinction, and enum fallback behavior when the registry snapshot is stale.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Exceptionally long single paragraph with no formatting, repeating tier details ("free and solo", "Premium", "Team or Company") multiple times. Much of the run-allowance and no-refund content belongs to sibling tools (get_my_capabilities, cancel_workflow) rather than this one. Front-loaded purpose is good but the body is dense and overwrought.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there's an output schema and rich sibling ecosystem, most return-format concerns are covered elsewhere. The description covers tier restrictions, prerequisites, gating semantics, and cost — enough for an agent to call correctly, though redundancy with sibling tools dilutes the value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already has its own description carrying framework-validity, jurisdiction ISO-2, parent_run_id/succession_reason pairing, and enum source. The tool description adds the tier-fencing angle (framework accepts only nis2/dora/cra/eu_ai_act at free/solo) but otherwise restates schema content. Baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Begin) and resource (structured workflow selected from live registry) and enumerates the catalog domains. Passively differentiates from siblings via enum examples matching list_workflow_types' authoritative-ids role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the prerequisite (call list_workflow_types first), names get_my_capabilities for remaining runs, names cancel_workflow's non-refund behavior on free/solo, and instructs the agent to confirm workflow_type with the user before calling. Tier-fencing tells the agent which types are/aren't available.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Ansvar: EU Compliance & Legal Intelligence toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources