DSGVO.pro — German Digital-Law Compliance

Start Website Compliance Scan

check-compliance

🔑 Requires API key (Bearer header in MCP client config). Free tier: 3 scans/month — get a key at https://dsgvo.pro/api-keys. Start a compliance scan against up to 33 German digital law modules. Standard tier covers 20 modules across DSGVO, TDDDG, DDG, BFSG, UWG, BGB, PAngV including Schrems II hosting-location verification with SCC declaration audit, §312k BGB Kündigungsbutton, BFSG accessibility (active 28.06.2025). Pro/Agency tier (13 exclusive modules): §356a BGB Widerrufsbutton (active 19.06.2026 — currently the only EU compliance-scanner with this check), KI-VO transparency and data-processing requirements (Article 13/14 + Article 50 AI Act), advanced security audit (Art. 32 DSGVO — TLS protocol, mixed content, CMS-version CVE detection), tech-stack staleness (CMS/framework versions vs NVD CVE database), plus 8 industry-specific compliance modules — lawyer (BORA/BRAO), real-estate broker (§34c GewO + MaBV + §87 GEG energy-pass disclosure in listings), physician (BOÄ + HWG + Art. 9 GDPR sensitive-data), financial intermediary (§34d/f/h/i GewO + FinVermV), gastronomy (LMIV allergen labeling + PAngV + IfSG hygiene), cosmetics studio (KosmetikVO + HWG before/after imagery), construction (§34c GewO Bauträger-Erlaubnis + HwO + MiLoG/SOKA), hotel (BMG registration + PAngV tourist-tax inclusive pricing + GEG). Industry detection runs from page content — only triggers relevant checks. ⚠️ IMPORTANT: This tool returns only a scanId — NOT the results. The scan takes 60–120 seconds. After calling this, wait 60–90 seconds, then call get-scan-result with the scanId. Use get-scan-status to check progress without waiting for completion.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`url`	Yes	The website URL to scan (e.g. https://example.com)

Output Schema

TableJSON Schema

Name	Required	Description
`url`	No	Normalized URL that is being scanned
`hint`	No
`error`	No	Set instead of scanId when the scan could not be started
`scanId`	No	Pass this to get-scan-status / get-scan-result
`status`	No	"pending" right after the scan is queued
`details`	No
`message`	No
`nextStep`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedAug 21, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "details": {
+      "type": "string"
+    },
+    "error": {
+      "description": "Set instead of scanId when the scan could not be started",
+      "type": "string"
+    },
+    "hint": {
+      "type": "string"
+    },
+    "message": {
+      "type": "string"
+    },
+    "nextStep": {
+      "type": "string"
+    },
+    "scanId": {
+      "description": "Pass this to get-scan-status / get-scan-result",
+      "type": "string"
+    },
+    "status": {
+      "description": "\"pending\" right after the scan is queued",
+      "type": "string"
+    },
+    "url": {
+      "description": "Normalized URL that is being scanned",
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

First observedAug 20, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description adds important behavioral context: API key requirement, free-tier limit of 3 scans/month, async execution taking 60–120 seconds, and the fact that the tool returns only a scanId. It thoroughly explains the operation's side effects and constraints without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long and dense, but most content earns its place: authentication, quotas, module coverage, async behavior, and post-call steps are all present. It is structured with emoji markers and clear sections, though the lengthy tier/module list slightly reduces readability and front-loading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex scanner tool, the description is exceptionally complete: auth requirements, provider endpoint, quota limits, module coverage, activation dates, asynchronous result handling, and the exact follow-up tools are all covered. The integration with sibling tools makes the full workflow actionable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents the single url parameter with an example. The description adds little about the parameter itself, but that is acceptable because schema coverage is 100% and there is only one parameter, so the schema carries the semantic load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: 'Start a compliance scan against up to 33 German digital law modules.' It clearly distinguishes itself from sibling tools by explicitly noting that it returns only a scanId, not actual results, which separates it from get-scan-result and get-scan-status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit workflow guidance: after calling this tool, wait 60–90 seconds, then call get-scan-result with the scanId, and use get-scan-status to check progress. It also names the alternative tools for retrieving outcomes, making when-to-use clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All DSGVO.pro — German Digital-Law Compliance tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?