required_fields

Instructions

Implementation Reference

• server.py:428-472 (handler)

  The 'required_fields' tool handler function. It checks access, then returns the AI_BOM_REQUIRED_FIELDS dictionary listing all 10 required field categories and their fields, along with source standards and supported formats.

  @mcp.tool()
  def required_fields(api_key: str = "") -> str:
      """List the 10 required AI-BOM field categories and their fields.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need structured analysis or classification
          of inputs against established frameworks or standards.
  
      When NOT to use:
          Not suitable for real-time production decision-making without
          human review of results.
  
      Args:
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg})
      return json.dumps({
          "source": "NIST SP 800-218 SSDF + CISA AI Cyber Report 2024 + EU AI Act Annex IV + CycloneDX 1.6 ML-BOM",
          "required_categories": AI_BOM_REQUIRED_FIELDS,
          "formats_supported": ["CycloneDX 1.6 ML-BOM (recommended)", "SPDX 3.0.1 AI profile"],
      }, indent=2)

• server.py:69-80 (schema)

  The AI_BOM_REQUIRED_FIELDS dictionary that defines the schema/data model for the 'required_fields' tool. It contains 10 categories (model_identity, model_architecture, training_data, fine_tuning, evaluation, dependencies, security_controls, governance, usage_restrictions, distribution) each with their required sub-fields.

  AI_BOM_REQUIRED_FIELDS = {
      "model_identity": ["name", "version", "organisation", "licence", "release_date", "model_id_hash"],
      "model_architecture": ["architecture_type", "parameter_count", "context_window", "framework", "training_compute_flops"],
      "training_data": ["dataset_sources", "dataset_sizes", "data_provenance", "filtering_applied", "synthetic_data_percent", "copyright_status"],
      "fine_tuning": ["base_model", "fine_tune_method", "fine_tune_dataset", "fine_tune_steps", "rlhf_applied"],
      "evaluation": ["benchmarks_run", "benchmark_scores", "bias_testing_results", "red_team_findings", "eval_dataset_hash"],
      "dependencies": ["inference_engines", "tokenisers", "safety_filters", "retrieval_systems", "tools_registered"],
      "security_controls": ["prompt_injection_defence", "output_filtering", "pii_scrubbing", "adversarial_robustness_rating"],
      "governance": ["risk_classification", "regulations_applicable", "human_oversight_mechanism", "incident_reporting_contact"],
      "usage_restrictions": ["acceptable_use_policy", "prohibited_use_cases", "export_control_status", "region_restrictions"],
      "distribution": ["distribution_channels", "access_controls", "update_cadence", "decommissioning_policy"],
  }

• server.py:428-429 (registration)

  The tool is registered with the MCP framework using the @mcp.tool() decorator on line 428, which makes the 'required_fields' function available as an MCP tool.

  @mcp.tool()
  def required_fields(api_key: str = "") -> str: