Skip to main content
Glama

DSGVO.pro — German Digital-Law Compliance

by pro.dsgvo
OverviewDiscussionsAdmin

Start Website Compliance Scan

check-compliance

🔑 Requires API key (Bearer header in MCP client config). Free tier: 3 scans/month — get a key at https://dsgvo.pro/api-keys. Start a compliance scan against up to 33 German digital law modules. Standard tier covers 20 modules across DSGVO, TDDDG, DDG, BFSG, UWG, BGB, PAngV including Schrems II hosting-location verification with SCC declaration audit, §312k BGB Kündigungsbutton, BFSG accessibility (active 28.06.2025). Pro/Agency tier (13 exclusive modules): §356a BGB Widerrufsbutton (active 19.06.2026 — currently the only EU compliance-scanner with this check), KI-VO transparency and data-processing requirements (Article 13/14 + Article 50 AI Act), advanced security audit (Art. 32 DSGVO — TLS protocol, mixed content, CMS-version CVE detection), tech-stack staleness (CMS/framework versions vs NVD CVE database), plus 8 industry-specific compliance modules — lawyer (BORA/BRAO), real-estate broker (§34c GewO + MaBV + §87 GEG energy-pass disclosure in listings), physician (BOÄ + HWG + Art. 9 GDPR sensitive-data), financial intermediary (§34d/f/h/i GewO + FinVermV), gastronomy (LMIV allergen labeling + PAngV + IfSG hygiene), cosmetics studio (KosmetikV + HWG before/after imagery), construction (§34c GewO Bauträger-Erlaubnis + HwO + MiLoG/SOKA), hotel (BMG registration + PAngV tourist-tax inclusive pricing + GEG). Industry detection runs from page content — only triggers relevant checks. ⚠️ IMPORTANT: This tool returns only a scanId — NOT the results. The scan takes 60–120 seconds. After calling this, wait 60–90 seconds, then call get-scan-result with the scanId. Use get-scan-status to check progress without waiting for completion.

Input Schema

NameRequiredDescriptionDefault
urlYesThe website URL to scan (e.g. https://example.com)

Output Schema

NameRequiredDescriptionDefault
urlNoNormalized URL that is being scanned
hintNo
errorNoSet instead of scanId when the scan could not be started
scanIdNoPass this to get-scan-status / get-scan-result
statusNo"pending" right after the scan is queued
detailsNo
messageNo
nextStepNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "details": {
+      "type": "string"
+    },
+    "error": {
+      "description": "Set instead of scanId when the scan could not be started",
+      "type": "string"
+    },
+    "hint": {
+      "type": "string"
+    },
+    "message": {
+      "type": "string"
+    },
+    "nextStep": {
+      "type": "string"
+    },
+    "scanId": {
+      "description": "Pass this to get-scan-status / get-scan-result",
+      "type": "string"
+    },
+    "status": {
+      "description": "\"pending\" right after the scan is queued",
+      "type": "string"
+    },
+    "url": {
+      "description": "Normalized URL that is being scanned",
+      "type": "string"
+    }
+  },
+  "type": "object"
+}
  2. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, destructiveHint=false. The description adds crucial behavioral context beyond annotations: requires API key with specific header location, free tier limit of 3 scans/month, scan duration 60-120 seconds, and critically that it returns only a scanId. This is exactly what the agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely long and front-loads an overwhelming amount of module/tier detail that is not essential for invoking the tool. While the critical warning about scanId appears later, the bulk of tier/module enumerations distracts from the core usage instructions. It is not appropriately sized or front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given output schema exists, description needn't explain return values, but it helpfully clarifies only a scanId is returned. It covers auth, limits, duration, and next steps. Slightly overcomplete on module details but complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with the url parameter fully documented in schema. Description doesn't add format details or constraints beyond what schema provides. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Start) and resource (compliance scan) with scope details — up to 33 German digital law modules. Clearly distinguishable from siblings like get-scan-result which retrieves results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use follow-up tools: wait 60-90 seconds then call get-scan-result with scanId; use get-scan-status to check progress. Also notes this tool returns only a scanId, not results, which routes the agent correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All DSGVO.pro — German Digital-Law Compliance toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources