Paperloo Compliance
Server Details
Automated website compliance infrastructure and GDPR/CCPA auditing.
- Status
- Healthy
- Uptime
- 0.1% over 20 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- Repository
- yassinemohamedali/Paperloo
- GitHub Stars
- 1
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 3 tools
Each tool targets a distinct action-object pair: auditing a URL, generating documents, and listing monitored sites. Although audit_site and list_sites both surface compliance grades, one is an active scan and the other is a registry read, so boundaries are clear.
All three tools follow a consistent snake_case verb_noun convention (audit_site, generate_documents, list_sites). No mixed casing or vague verbs.
Three tools cover the core audit/generate/monitor loop without bloat, but the set is on the thin side for a compliance platform. A site-management or document-retrieval tool would round it out.
There is no tool to add, register, or remove a monitored site even though list_sites implies a managed site registry, and no way to fetch or download previously generated documents. Agents can still audit arbitrary URLs and generate docs, so core flows work but lifecycle gaps exist.
Available Tools
3 toolsaudit_siteAInspect
Performs multi-vector automated compliance auditing on a target website URL. Checks cookie banner presence, Google Consent Mode v2 signals, GTM tag firing, legal links, and security headers.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The full website URL to audit | |
| deep_scan | No | Whether to execute deep DOM inspection and sub-resource tracker verification |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the inspection vectors (DOM/tracker checks, consent signals, headers), which is useful context beyond a bare name. However, it omits key behavioral facts: that auditing presumably loads the target page and fires third-party requests, whether it is non-destructive, how long a scan takes, and any auth or rate-limit constraints. Enough to know what happens, not enough to know the cost or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and followed by the enumerated check list. No filler, no restating of the name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool this is close to adequate, but with no annotations and no output schema, the description should say something about what comes back (a findings report? a pass/fail summary per check?) and about the deep_scan default. An agent knows what the tool does but not what it gets back or what calling it costs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains both url and deep_scan; the baseline of 3 applies. The description adds no meaning beyond the schema — notably it never explains the trade-off of deep_scan (depth vs. speed/heaviness), which would have been a genuine value-add.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Performs multi-vector automated compliance auditing') on a specific resource ('target website URL') and enumerates the exact checks performed: cookie banner, Consent Mode v2, GTM tag firing, legal links, security headers. This is clearly distinguishable from siblings generate_documents and list_sites without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never states when to use this tool versus alternatives, nor any preconditions (e.g., whether the site must first be registered via list_sites). There is no guidance on when-not-to-use, expected runtime, or how deep_scan=true (the default) changes the decision to call it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_documentsBInspect
Generates tailored legal document suites (Privacy Policy, Terms of Service, Cookie Policy, EULA, Acceptable Use, Disclaimer) assembled from modular statutory clauses grounded in EDPB, CPPA, and ICO regulator guidance.
| Name | Required | Description | Default |
|---|---|---|---|
| siteId | No | Site UUID to attach generated documents to (optional) | |
| website_url | Yes | Public website domain URL | |
| company_name | Yes | Legal entity or company name | |
| contact_email | Yes | Official legal and privacy contact email | |
| jurisdictions | No | Target jurisdictions (e.g. ['GDPR', 'CCPA']) | |
| collects_minors | No | Whether services are accessible to or directed at minors under 13/16 | |
| uses_meta_pixel | No | Whether Meta (Facebook) advertising pixels are deployed | |
| collects_cookies | No | Whether the site uses cookies or browser local storage | |
| physical_address | No | Registered business mailing address | 100 Compliance Way, San Francisco, CA 94105 |
| has_user_accounts | No | Whether end-users can register accounts or log in | |
| processes_payments | No | Whether the site processes payments via Stripe, PayPal, or merchant processors | |
| refund_period_days | No | Refund policy guarantee window in days (minimum 14 for EU) | |
| data_retention_months | No | Data retention period in months | |
| uses_google_analytics | No | Whether Google Analytics 4 or Google Tag Manager is utilized |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and mostly does not. It does not say whether the generated documents are returned inline, persisted to the site (despite the siteId parameter hinting at attachment), whether regeneration overwrites prior versions, or whether output is legally binding advice requiring review. Only the statutory provenance is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the identifying noun phrase and provenance front-loaded and no filler. It is efficiently sized, though it spends its words on cataloging document types rather than on behavior an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-parameter generative tool with zero annotations and no output schema, the definition is thin on the things an agent cannot see structurally, namely what gets produced or returned and whether any persistence or overwrite occurs. The schema does cover every parameter fully, which keeps this from being inadequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 14 parameters, their defaults, and their meaning are already documented in the schema, which sets the baseline at 3. The description adds only domain framing (which document suite is produced and what guidance it draws on) and no additional meaning about how jurisdictions, boilerplate defaults, or conditional flags change the generated output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ("Generates") and a specific resource ("tailored legal document suites"), then enumerates the document types and the regulatory basis (EDPB, CPPA, ICO). An agent can tell this apart from audit_site and list_sites, though the description makes no explicit reference to those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by naming the inputs it expects a site and company to supply, but gives no explicit when-to-use criteria, no prerequisites, and no routing advice versus the sibling tools. An agent must infer from the parameter list that this is the authoring step in a generate/audit/list workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sitesBInspect
Lists all monitored websites, their real-time compliance grades (A+ to F), cookie banner status, GTM container state, and document count.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter sites by status: 'all', 'active', 'compliant', 'needs_audit' | all |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden: it does disclose what data comes back (grades, banner status, GTM container state, document count), which is useful behavioral context for a read tool. However, it says nothing about scope (workspace/account), result volume, pagination, or ordering, and never states explicitly that the call is non-mutating.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense, front-loaded sentence with no filler; every clause names something the caller will actually receive. Minor tension between 'all' and the existence of a filter parameter keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description is largely sufficient because it enumerates the returned fields the agent would otherwise have to guess. Gaps around pagination, scope, and result size are minor but real.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'filter' parameter is fully documented in the schema, so the baseline is 3. The description adds nothing about the filter and in fact says 'Lists all', which slightly undersells the filtering capability rather than clarifying it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb plus a well-scoped resource ('Lists all monitored websites') and enumerates the returned attributes (grades, banner status, GTM state, document count), so an agent knows exactly what this retrieves. It does not explicitly differentiate itself from siblings audit_site and generate_documents, which is the only thing keeping it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no mention of when not to use it, and no reference to the sibling tools (audit_site for auditing, generate_documents for document work). The only signal is the implied 'browse/inventory' semantics of a list call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
- First observed
audit_site - First observed
generate_documents - First observed
list_sites
Related MCP Connectors
GDPR/CCPA cookie consent: scan sites for cookies, track consent rates, generate privacy policies.
Cookie consent scanner: GDPR, CCPA, GCMv2. PASS/FAIL compliance checklists with fix recommendations.
Cookie consent for GDPR/CCPA: scan sites for trackers, configure consent banners, get install code.
EU cookie-consent & tracker audit, run like a real first-time visitor (EU proxies). Free quick check, no account. Finds trackers and tracking cookies before consent, missing first-layer Reject, what still fires after Reject, Google Consent Mode v2 state per signal, plus Google Fonts/YouTube/Maps/reCAPTCHA. Every finding comes with the exact request as evidence and a concrete fix, in 13 languages. Weekly monitoring, white-label PDF for agencies, private share links. Works with any CMP (Cookiebot, Usercentrics, Complianz, CookieYes, Borlabs…).
Related MCP Servers
AlicenseAqualityDmaintenanceMCP server that audits websites for GDPR, CCPA, and ePrivacy compliance.445 npm1MIT- AlicenseNot gradedqualityDmaintenanceThe only Multi-LLM Compliance Engine (GPT-4o + Claude + DeepSeek). Auto-fix GDPR/LGPD risks and more 15 frameworks. code.guard.eu4 npm1MIT
- AlicenseAqualityDmaintenanceProvides automated EU AI Act compliance tools, including risk classification, role determination, transparency disclosures, content watermarking, deepfake labeling, and security threat detection.1633Apache 2.0
- AlicenseAqualityDmaintenanceCompliance and guardrails infrastructure for AI agents, enabling safe operations within regulatory boundaries like GDPR and EU AI Act.625 PyPIMIT
Glama MCP Gateway
Add one secure layer between your agents and this server.