Skip to main content
Glama
Ansvar-Systems

Estonian Cybersecurity MCP

Estonian Cybersecurity MCP

▶ Try this MCP instantly via Ansvar Gateway

50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway

One endpoint, one OAuth signup, access from any MCP-compatible client.

Connect

Claude Code (one line):

claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcp

Claude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):

{
  "mcpServers": {
    "ansvar": {
      "type": "url",
      "url": "https://gateway.ansvar.eu/mcp"
    }
  }
}

Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp

First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.


Self-host this MCP

You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.

Build your own: run this repo's ingestion script (entry-point varies per repo — typically scripts/ingest.sh, npm run ingest, or make ingest; check the repo root).

Estonian cybersecurity data for AI compliance tools.

License CI

Query Estonian cybersecurity data -- regulations, decisions, and requirements from RIA/CERT-EE (Information System Authority) -- directly from Claude, Cursor, or any MCP-compatible client.

Built by Ansvar Systems -- Stockholm, Sweden


Related MCP server: Portuguese Cybersecurity MCP

Available Tools (6)

Tool

Description

ee_cyber_search_guidance

Full-text search across RIA cybersecurity guidelines, directives, and technical standards. Covers ISKE security frame...

ee_cyber_get_guidance

Get a specific RIA guidance document by reference (e.g.,

ee_cyber_search_advisories

Search CERT-EE security advisories and incident alerts. Returns advisories with severity, affected products, and CVE ...

ee_cyber_get_advisory

Get a specific CERT-EE security advisory by reference (e.g.,

ee_cyber_list_frameworks

List all RIA/CERT-EE cybersecurity frameworks covered in this MCP, including ISKE, national cybersecurity strategy, a...

ee_cyber_about

Return metadata about this MCP server: version, data source, coverage, and tool list.

All tools return structured data with source references and timestamps.


Data Sources and Freshness

All content is sourced from official Estonian regulatory publications:

  • RIA/CERT-EE (Information System Authority) -- Official regulatory authority

Data Currency

  • Database updates are periodic and may lag official publications

  • Freshness checks run via GitHub Actions workflows

  • Last-updated timestamps in tool responses indicate data age

See sources.yml for full provenance metadata.


Security

This project uses multiple layers of automated security scanning:

Scanner

What It Does

Schedule

CodeQL

Static analysis for security vulnerabilities

Weekly + PRs

Semgrep

SAST scanning (OWASP top 10, secrets, TypeScript)

Every push

Gitleaks

Secret detection across git history

Every push

Trivy

CVE scanning on filesystem and npm dependencies

Daily

Docker Security

Container image scanning + SBOM generation

Daily

Socket.dev

Supply chain attack detection

PRs

Dependabot

Automated dependency updates

Weekly

See SECURITY.md for the full policy and vulnerability reporting.


Important Disclaimers

Not Regulatory Advice

THIS TOOL IS NOT REGULATORY OR LEGAL ADVICE

Regulatory data is sourced from official publications by RIA/CERT-EE (Information System Authority). However:

  • This is a research tool, not a substitute for professional regulatory counsel

  • Verify all references against primary sources before making compliance decisions

  • Coverage may be incomplete -- do not rely solely on this for regulatory research

Before using professionally, read: DISCLAIMER.md | PRIVACY.md

Confidentiality

Queries go through the Claude API. For privileged or confidential matters, use on-premise deployment. See PRIVACY.md for details.


Development

Setup

git clone https://github.com/Ansvar-Systems/estonian-cybersecurity-mcp
cd estonian-cybersecurity-mcp
npm install
npm run build
npm test

Running Locally

npm run dev                                       # Start MCP server
npx @anthropic/mcp-inspector node dist/index.js   # Test with MCP Inspector

Data Management

npm run build:db       # Rebuild SQLite database from seed data
npm run check-updates  # Check for new regulatory data

More Ansvar MCPs

Full fleet at ansvar.eu/gateway.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.


License

Apache License 2.0. See LICENSE for details.

Data Licenses

Regulatory data sourced from official government publications. See sources.yml for per-source licensing details.


About Ansvar Systems

We build AI-powered compliance and legal research tools for the European market. Our MCP fleet provides structured, verified regulatory data to AI assistants -- so compliance professionals can work with accurate sources instead of guessing.

ansvar.eu -- Stockholm, Sweden


Available Tools

6 tools
ee_cyber_aboutA

Return metadata about this MCP server: version, data source, coverage, and tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral disclosure burden. It fully describes the read-only nature ('Return metadata') and the exact fields returned. No mutation, side effects, or hidden requirements are relevant for this simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the verb and resource, followed by a concise enumeration of returned fields. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter server-info tool with no output schema, the description is entirely sufficient: it names the core returned elements and distinguishes the tool from content-focused siblings. Nothing necessary is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema needs no elaboration; baseline for 0-parameter tools is 4. The description does not introduce any parameter-related ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Return' with explicit object 'metadata about this MCP server' and enumerates concrete content: version, data source, coverage, tool list. Clearly distinct from sibling tools that search/retrieve guidance and advisories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes clear this is for server-level metadata, not domain content, so an agent can infer when to select it. It does not explicitly name alternative tools or exclusion conditions, but the context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_cyber_get_advisoryA

Get a specific CERT-EE security advisory by reference (e.g., 'CERT-EE-2024-001').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesCERT-EE advisory reference (e.g., 'CERT-EE-2024-001')

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full weight. It implies a read-only lookup with an exact reference but does not disclose behavior on missing/unknown references or describe the shape/content of the returned advisory. This is acceptable for a simple getter but leaves some edge-case behavior unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the action and target. It conveys everything necessary without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup tool with full schema coverage and no nested objects, the description is largely sufficient. The only minor gap is the lack of any mention of return contents or not-found behavior, which would be useful given there is no output schema, but the tool's simplicity keeps this from being a major omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the 'reference' parameter is already fully documented in the schema. The description adds only an example that duplicates the schema's example, so it adds no significant meaning beyond the structured definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb ('Get') and resource ('CERT-EE security advisory') with a precise key ('by reference') and a concrete example. It is clearly distinct from sibling search tools like ee_cyber_search_advisories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'by reference' makes the retrieval context clear: use when you already have an exact advisory ID. It does not explicitly name search_advisories as the alternative for queries without a reference, so it lacks an explicit when-not, but the intended usage is evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_cyber_get_guidanceA

Get a specific RIA guidance document by reference (e.g., 'RIA-ISKE-2023', 'RIA-juhend-001', 'CERT-EE-TG-2024-01').

ParametersJSON Schema
NameRequiredDescriptionDefault
referenceYesRIA document reference (e.g., 'RIA-ISKE-2023', 'RIA-juhend-001')

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the behavioral burden. It clearly indicates a read-only 'get' operation and specifies the exact target resource. It does not describe error behavior or response format, but the simple fetch-by-reference nature is transparent enough; the verb 'Get' and resource phrasing provide the key behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, well-structured sentence that front-loads the action and resource, then adds high-value examples. No filler or redundant wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter retrieval tool with no output schema and no annotations, the description is nearly complete: it states what is returned and how to specify it. Minor omissions such as error handling or exact response format are acceptable given the low complexity and the clarity of the described operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% description coverage for the single parameter, so the baseline is met. The description goes beyond the schema by giving multiple concrete reference format examples ('RIA-ISKE-2023', 'RIA-juhend-001', 'CERT-EE-TG-2024-01'), which helps the agent understand expected syntax and naming patterns.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('RIA guidance document'), and clearly identifies the selection method ('by reference'). It distinguishes this tool from the sibling search tools by emphasizing retrieval of a specific known document rather than discovery or listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool should be used when the agent already has a document reference, and the examples reinforce that. However, it does not explicitly state when not to use it or mention that ee_cyber_search_guidance should be used when the reference is unknown, leaving the contrast with siblings implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_cyber_list_frameworksA

List all RIA/CERT-EE cybersecurity frameworks covered in this MCP, including ISKE, national cybersecurity strategy, and NIS2 implementation framework.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. 'List all' clearly signals a read-only enumeration, and 'covered in this MCP' scopes the behavior to a curated internal catalog. It could add more detail about result structure or lack of side effects, but for a no-param listing tool the core behavior is sufficiently disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that states the operation first and then gives useful examples. Every word contributes meaning, with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter list operation, the description is largely complete: it identifies the resource, the scope, and examples. Since there is no output schema, the agent must infer the return shape from 'List,' but the expected result is straightforward enough that this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the baseline for this dimension is 4. The description adds no parameter-specific detail, but none is needed because the input schema is empty and cannot be misunderstood.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') with a clear resource ('all RIA/CERT-EE cybersecurity frameworks covered in this MCP'). It names concrete examples (ISKE, national cybersecurity strategy, NIS2 implementation framework) and is clearly distinct from the sibling advisory/guidance tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: when the agent needs the complete catalog of frameworks covered by this MCP. However, it does not explicitly state when not to use it or name any alternative tool, so usage guidance is only implicit rather than prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_cyber_search_advisoriesA

Search CERT-EE security advisories and incident alerts. Returns advisories with severity, affected products, and CVE references where available.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query (e.g., 'kriitiline haavatavus', 'lunavara', 'andmelekkimine')
severityNoFilter by severity level. Optional.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. It does disclose the return content and notes CVE references are included 'where available', which is useful, but it does not mention potential side effects, data freshness, pagination behavior, or whether incident alerts differ from advisories.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The main search action and target resource are front-loaded, and the return-value sentence adds meaningful context without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward search tool, the description plus fully documented schema gives enough to call it correctly. However, the lack of an output schema and annotations means the agent gets no detail on result formatting, ordering, or how the returned fields map to the query, leaving some ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters already have clear descriptions in the input schema, including an enum for severity and examples for query. The tool description repeats only the concept of severity and CVE references without adding new parameter-level meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the operation as 'Search CERT-EE security advisories and incident alerts', which is a specific verb and resource. It also tells the caller what kind of results to expect (severity, affected products, CVE references), making it distinguishable from siblings like search_guidance or list_frameworks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when this tool should be used instead of ee_cyber_get_advisory or ee_cyber_search_guidance. There is no mention of alternatives or exclusion criteria, so the agent must infer usage solely from the tool name and resource type.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ee_cyber_search_guidanceA

Full-text search across RIA cybersecurity guidelines, directives, and technical standards. Covers ISKE security framework requirements, RIA guidance documents, NIS2 implementation guidance, and national cybersecurity strategy documents. Returns matching documents with reference, title, series, and summary.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by document type. Optional.
limitNoMaximum number of results to return. Defaults to 20.
queryYesSearch query (e.g., 'ISKE turvaklass', 'intsidentide käsitlemine', 'küberturvalisus')
seriesNoFilter by RIA series. Optional.
statusNoFilter by document status. Defaults to returning all statuses.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden and it does reasonably well: 'Full-text search' and 'Returns matching documents with reference, title, series, and summary' communicate a read-only search behavior and output shape. It does not mention pagination, result ordering, or authentication requirements, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences: the first states the action and corpus; the second lists covered sources and return fields. No filler or repetition; the headline verb is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-output-schema search tool, the description names the return fields and the document sources, and the schema covers all parameter constraints and defaults. The main contextual gap is routing guidance versus ee_cyber_search_advisories, already penalized in usage_guidelines.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters (query, type, limit, series, status) are already fully documented in the schema. The description adds no extra parameter-level meaning, which matches the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Full-text search across RIA cybersecurity guidelines, directives, and technical standards.' The scope is clear and the content list (ISKE, RIA guidance, NIS2, national strategy) makes the searchable corpus specific, but it does not explicitly distinguish itself from the sibling ee_cyber_search_advisories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool over siblings such as ee_cyber_get_guidance or ee_cyber_search_advisories, and no exclusions or alternative routing. The coverage list implies a search use case, but agents must infer when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedee_cyber_about
    • First observedee_cyber_get_advisory
    • First observedee_cyber_get_guidance
    • First observedee_cyber_list_frameworks
    • First observedee_cyber_search_advisories
    • First observedee_cyber_search_guidance

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct operation and resource type: guidance search/retrieval, advisory search/retrieval, framework listing, and server metadata. There is no meaningful overlap between the search and get tools since one returns result sets and the other fetches a specific document by reference.

Naming Consistency4/5

Tool names follow a consistent ee_cyber_ prefix with clear verb-noun patterns for most tools, such as search_guidance, get_guidance, search_advisories, and list_frameworks. The 'about' tool deviates slightly from the verb_noun convention but is still predictable and readable.

Tool Count5/5

Six tools is an appropriate, focused size for a read-only cybersecurity document and advisory retrieval server. Each tool serves a clear purpose without bloat, and the count matches the apparent scope well.

Completeness5/5

The tool set covers the core domain needs: searching and retrieving both guidance documents and advisories, listing available frameworks, and providing server metadata. For a read-only reference server, this is a complete and usable surface with no obvious dead ends.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers