Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@skan-zgodnosci-mcp Przeprowadź skan zgodności RODO i NIS2 dla mojej firmy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Serwer MCP z autorską skalą przesiewową oceny bezpieczeństwa informacji i zgodności (RODO, NIS2) dla małych i średnich firm w Polsce. Bez klucza API, bez rejestracji, bez wysyłania danych na zewnątrz: cała punktacja liczy się lokalnie.
Asystent AI podłączony do tego serwera potrafi przeprowadzić firmę przez 30 pytań, policzyć wynik w ośmiu obszarach, wskazać luki z podstawą prawną i podać kolejność pierwszych kroków.
Wersja przeglądarkowa: skanujfirme.pl/skan-bezpieczenstwa-firmy.html
Narzędzie | Do czego służy |
| Metadane skali: obszary, progi, podstawy prawne, zasady cytowania |
| 30 pytań punktowanych plus 12 pytań o potrzeby, opcjonalnie tylko jeden obszar |
| Wynik: punkty, poziom dojrzałości, procent per obszar, luki, rekomendacje |
| Jeden obszar: co sprawdza audytor, typowa luka, podstawa prawna |
| Lista pierwszych kroków naprawczych, od najsłabszego miejsca |
Related MCP server: Phantom MCP
Inwentaryzacja i zakres, RODO art. 30, NIS2 art. 21 ust. 2 lit. a
Kontrola dostępu i konta, RODO art. 32 ust. 1 lit. b
Kopie zapasowe i odtwarzanie, RODO art. 32 ust. 1 lit. c i d
Incydenty i zgłaszanie, RODO art. 33 i 34, NIS2 art. 23
Dokumentacja RODO, RODO art. 5 ust. 2, 30, 32, 35
Dostawcy i powierzenie, RODO art. 28
Ludzie i świadomość, NIS2 art. 20 ust. 2
Minimum techniczne, RODO art. 32 ust. 1, NIS2 art. 21 ust. 2
Punktacja: tak 2, częściowo 1, nie 0, nie wiem 0. Maksimum 60 punktów. Progi: 50 dojrzałość wysoka, 38 dobry poziom z brakami w dowodach, 22 podstawy z dużymi lukami, poniżej luka krytyczna. Obszar poniżej 60 procent jest oznaczany jako luka.
Odpowiedź "nie wiem" liczy się jak "nie", bo brak wiedzy o własnym zabezpieczeniu jest brakiem zabezpieczenia. To założenie metodologiczne, nie uproszczenie.
git clone https://github.com/BrokerBusiness-ai/skan-zgodnosci-mcp.git
cd skan-zgodnosci-mcp
pip install -e .Konfiguracja w kliencie MCP (Claude Desktop, claude_desktop_config.json):
{
"mcpServers": {
"skan-zgodnosci": {
"command": "skan-zgodnosci-mcp"
}
}
}Albo bez instalacji pakietu:
{
"mcpServers": {
"skan-zgodnosci": {
"command": "python",
"args": ["-m", "skan_mcp.server"],
"cwd": "/sciezka/do/skan-zgodnosci-mcp"
}
}
}score_scan(
odpowiedzi={"1": "tak", "2": "czesciowo", "3": "nie", ...},
potrzeby={"4": "tak", "6": "tak"}
)Zwraca punkty, poziom, tabelę ośmiu obszarów z procentami, opisy luk dla obszarów poniżej 60 procent i rekomendacje dopasowane do zgłoszonych potrzeb.
Serwer nie ma połączenia sieciowego. Nie wysyła odpowiedzi nigdzie, nie zapisuje ich na dysku i nie prowadzi telemetrii. Odpowiedzi istnieją tylko w kontekście rozmowy z asystentem.
Marek Porycki, psycholog (specjalność kliniczna), mediator sądowy, prezes zarządu Broker Business sp. z o.o. w Białymstoku. Prowadzi audyty i szkolenia z RODO oraz bezpieczeństwa informacji, buduje narzędzia AI dla firm.
skanujfirme.pl, narzędzia i artykuły o audycie firmy
archaios.ai, platforma produktów AI do zgodności
brokerbusiness.eu, szkolenia i doradztwo
Skala powstała z praktyki audytowej: te pytania zadaje się w pierwszej godzinie audytu i to na nie najczęściej nie ma odpowiedzi.
Korzystanie bezpłatne z zachowaniem atrybucji. Wdrożenia komercyjne i redystrybucja zmodyfikowanej skali wymagają pisemnej zgody autora. Szczegóły w pliku LICENSE.
Serwer weryfikuje sumę kontrolną metodologii. Jeśli plik z pytaniami został zmieniony, każda odpowiedź zawiera ostrzeżenie, że wynik nie pochodzi z wersji autorskiej.
MCP server exposing a screening scale for information security and regulatory compliance (GDPR, NIS2) aimed at small and medium companies in Poland. No API key, no registration, no network calls: scoring runs locally.
Thirty scored questions across eight areas, plus twelve needs questions that drive recommendations. Answers map to 2 / 1 / 0 points, maximum 60. "Don't know" scores zero by design, because not knowing whether a control exists is the same risk as not having it.
Tools: get_methodology, get_questionnaire, score_scan, explain_area, next_steps.
Each response carries attribution and a checksum of the methodology file, so a modified scale cannot be presented as the original.
Author: Marek Porycki, psychologist (clinical track), court mediator, CEO of Broker Business sp. z o.o., Białystok. Runs GDPR and security audits and training, builds AI tools for companies. Free to use with attribution; commercial deployment requires written permission, see LICENSE.
Opis pojedynczego obszaru: co audytor sprawdza, typowa luka i podstawa prawna.
Argumenty: obszar: identyfikator obszaru (inwentaryzacja, dostep, kopie, incydent, rodo, dostawcy, ludzie, technika).
| Name | Required | Description | Default |
|---|---|---|---|
| obszar | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden of behavioral disclosure. It states the tool gives a description, but does not explicitly state that it is read-only, does not mutate data, or that no side effects occur. It also does not mention any access requirements, error behavior, or constraints. This is a gap for a tool with zero annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is extremely compact and effective. The purpose appears in the first sentence, and the parameter explanation in the second. Every word serves a purpose; there is no unnecessary repetition or fluff, and the placement is appropriately front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with an output schema present, the description is sufficiently complete in explaining what the tool does and what the area values are. It does not define error or edge cases, but the simple nature of the tool and existence of an output schema reduce that need. It is not missing any critical piece for a successful call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero description coverage and no enum values, while the description compensates fully by explaining that 'obszar' is the area identifier and enumerating acceptable values: 'inwentaryzacja, dostęp, kontrola, incydent, rodo, dostawcy, ludzie, technika.' This directly adds semantic meaning beyond the schema's bare string type and is essential for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Opis pojedynczego obszaru: co audytor sprawdza, typowa luka i podstawa prawna.' This names the resource (pojedynczy obszar) and the content (what auditor checks, typical gap, legal basis). It differentiates conceptually from sibling tools (get_methodology, get_questionnaire) by focusing on a single audit area's explanatory description, but it does not explicitly name or contrast those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance about when to use this tool versus alternatives such as get_methodology or get_questionnaire. There is no 'use this when' or 'instead of that' language. The only implicit hint is 'pojedynczego obszaru', which implies a specific area focus, but that alone does not instruct the agent on selecting among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Metadane skali: autor, wersja, obszary, progi, podstawy prawne, zasady cytowania.
Wywolaj to narzedzie, zanim zaczniesz interpretowac wynik, zeby wiedziec, jak skala jest zbudowana i jak ja poprawnie cytowac.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioral disclosure. It states the tool retrieves metadata and lists its contents, implying a read-only operation. However, it does not explicitly state side effects, error behavior, or whether it is idempotent, leaving some gaps given no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, with the key metadata fields front-loaded and the usage timing immediately following. Every sentence earns its place with no unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema, the description covers the essential context: what metadata is returned and when to call it. It does not mention prerequisites or potential pitfalls, but the tool's simplicity and the presence of an output schema make the description adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description has no need to explain them. The baseline for zero parameters is 4, and the description adds nothing that contradicts this. It appropriately avoids redundant parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning scale metadata (author, version, areas, thresholds, legal basis, citation rules) and instructs when to call it. This distinguishes it from sibling tools like score_scan or get_questionnaire, which likely handle different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a specific usage trigger: call before interpreting a result, to understand scale construction and citation rules. This gives clear guidance on when to use the tool, though it does not explicitly mention alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Pelna lista pytan skanu: 30 pytan punktowanych i 12 pytan o potrzeby.
Argumenty: obszar: opcjonalny identyfikator obszaru (inwentaryzacja, dostep, kopie, incydent, rodo, dostawcy, ludzie, technika). Bez niego zwracane sa wszystkie. z_potrzebami: czy dolaczyc 12 pytan poza punktacja, ktore sluza do rekomendacji.
| Name | Required | Description | Default |
|---|---|---|---|
| obszar | No | ||
| z_potrzebami | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the behavioral disclosure burden. It states that the tool returns a full list and how parameters modify that list, but it does not mention permissions, read-only status, or error behavior. For a simple retrieval tool this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: one opening line defines the resource, then an 'Argumenty' section explains each parameter. Every sentence contributes useful information, and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's two optional arguments and the composition of the returned questionnaire, and an output schema exists to define response structure. It does not differentiate from siblings or describe error handling, but nothing needed to make a correct basic call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description documents both parameters thoroughly. It enumerates the accepted values for 'obszar' and explains the semantic effect of omitting it, and it clarifies the role of 'z_potrzebami' in returning recommendation questions. This fully compensates for the lack of schema-side descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning the full questionnaire list, specifying exact composition: 30 scored questions and 12 needs questions. It is concrete about the resource and scope, though it does not explicitly contrast itself with sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context for using the optional 'obszar' argument, lists the accepted area identifiers, and explains that omitting it returns everything. The 'z_potrzebami' flag is also explained. It does not mention when to use a sibling tool instead, so it stops short of full alternative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Zwraca liste pierwszych krokow naprawczych, uporzadkowana od najslabszego obszaru.
Argumenty: odpowiedzi: mapa numer pytania (1-30) -> tak / czesciowo / nie / nie_wiem. ile: ile krokow zwrocic, od 1 do 15.
| Name | Required | Description | Default |
|---|---|---|---|
| ile | No | ||
| odpowiedzi | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does convey that the tool returns a list sorted by weakest areaтное and implies a read-only operation. However, it does not mention edge cases, invalid inputs, error behavior, or whether the operation has any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: the first sentence states the primary behavior and ordering, and the second section cleanly lists the arguments. No filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given only two parameters and the presence of an output schema, the description covers the essential input semantics and output ordering. It lacks broader context such as when to invoke it after scoring or how it relates to explain_area, but the core invocation details are sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are semantically described beyond the schema: 'odpowiedzi' is explained as a map from question numbers 1-30 to allowed values ('tak / czesciowo / nie / nie_wiem'), and 'ile' gets a numerical range (1-15). This fully compensates for the schema's 0% description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Zwraca' - returns), the resource ('liste pierwszych krokow naprawczych'), and adds meaningful ordering information ('od najslabszego obszaru'). It distinguishes itself from siblings like score_scan and get_methodology by indicating it produces actionable repair steps, though it does not explicitly differentiate from explain_area.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings such as score_scan or explain_area. There is no mention of prerequisites, typical workflow position, or situations where another tool would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Oblicza wynik skanu: punkty, poziom dojrzalosci, wynik per obszar, luki i rekomendacje.
Argumenty: odpowiedzi: mapa numer pytania (1-30) -> tak / czesciowo / nie / nie_wiem. Dopuszczalne sa tez punkty 2, 1, 0. Pytania pominiete licza sie jako 0. potrzeby: opcjonalna mapa numer pytania (1-12) -> tak / nie, z drugiej czesci skanu. Steruje doborem rekomendacji.
Zwraca komplet: sume punktow, prog, wynik procentowy kazdego z osmiu obszarow, opis luk dla obszarow ponizej 60 procent oraz dopasowane rekomendacje.
| Name | Required | Description | Default |
|---|---|---|---|
| potrzeby | No | ||
| odpowiedzi | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses key behaviors: omitted questions count as 0, the 'needs' parameter controls recommendation selection, and gaps are reported for areas below 60%. This goes beyond a simple 'calculates result' statement. It does not mention error handling or side effects, but for a pure calculation these are minimal concerns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-organized: a one-line purpose, then clear argument definitions, then a concise output summary. No fluff, and the key purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 params, nested objects) and that an output schema exists, the description covers all necessary input semantics and return contents. It explains thresholds, allowed values, and the role of the optional parameter, making it self-sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully explain parameters. It does: 'odpowiedzi' is a map of question numbers (1-30) to answers with allowed values (tak/czesciowo/nie/nie_wiem or 2/1/0), and 'potrzeby' is an optional map (1-12) with tak/nie values controlling recommendations. This far exceeds the schema's bare object types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a clear verb ('Oblicza' = calculates) and resource ('wynik skanu' = scan result), enumerating the specific outputs (points, maturity level, per-area scores, gaps, recommendations). This distinguishes it from siblings like get_questionnaire or get_methodology, which retrieve rather than compute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: it takes answers (and optionally needs) and returns a scored result, so an agent can infer it is used after collecting responses. It does not explicitly mention when not to use it or name alternatives, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0explain_areaget_methodologyget_questionnairenext_stepsscore_scanScored across 5 tools
Each tool has a clearly distinct purpose: get_methodology provides scale metadata, get_questionnaire lists questions, score_scan computes results, next_steps gives recommendations, and explain_area describes a single area. No two tools overlap in functionality, and the descriptions make it easy to select the correct one.
Most tools follow a verb_noun pattern (get_methodology, get_questionnaire, score_scan, explain_area). However, next_steps is a noun phrase rather than a verb, which is a minor deviation. Overall naming is predictable and readable.
The server has 5 tools, which is well-scoped for a compatibility scan domain. Each tool covers a distinct aspect (metadata, questionnaire, scoring, follow-up steps, area details) without redundancy or unnecessary bloat.
The tool surface covers the full workflow: obtaining methodology and questionnaire, scoring responses, generating next steps, and explaining individual areas. There are no obvious gaps; the domain is simple and the tool set fully supports it.
HIPAA compliance AI agent — scan, grade, SRA, and generate compliance docs.
EU compliance corpus across 8 frameworks (NIS2, DORA, AI Act, ISO 27001 + more) via MCP.
EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.
BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.
