Skip to main content
Glama

ClevSec EU compliance tools

DORA requirements checklist

dora_checklist
Read-onlyIdempotent

Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
microenterpriseNoThe financial entity is a microenterprise (DORA Art. 3(60))
simplified_frameworkNoThe entity is listed in DORA Art. 16(1) and uses the simplified framework

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, so safety is covered. The description adds real behavioral content by disclosing the filtering rule: requirements DORA itself disapplies for microenterprises or the Art. 16 simplified framework are omitted. It does not state whether the checklist is exhaustive or versioned against an amendment date, but the filtering disclosure is a meaningful addition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first front-loads the invocation triggers, the second delivers the output shape and the exclusion rule. No filler, no repetition of the title, and it ends on the constraint an agent would otherwise have to discover empirically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still characterizes the return value (core requirements grouped by section, each with its article) and explains the one behavioral wrinkle (conditional exclusions). Both parameters are optional, both are documented, and the annotations cover the safety profile, so nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description goes further by explaining the consequence of each flag — the two booleans cause disapplied requirements to be left out of the result, not merely labeled. That param-to-output linkage is genuine meaning beyond the schema's per-field prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities' — and specifies the granularity (grouped by section, with the governing article). This is clearly distinguishable from sibling checks like nis2_gap_assessment or cra_reporting_check, which target different regimes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit triggers are given: 'what does DORA require?', DORA compliance checklists, or gap reviews. However, no when-not guidance is offered even though nis2_gap_assessment and dora_classify_incident sit in the same compliance-advice family and could be confused with a 'gap review' request.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources