Skip to main content
Glama
CSOAI-ORG

AI Incident Reporting MCP

MCP Scorecard: 90/100

Ai Incident Reporting MCP

mcp-name: io.github.CSOAI-ORG/ai-incident-reporting-mcp

AI Incident Reporting Compliance MCP

⚖️ Built by MEOK AI Labs / CSOAI. Need this applied to your system fast? Book a 30-min Founder Office Hour (£29) → https://meok.ai/work · Full governance platform → https://meok.ai

MEOK AI Labs EU AI Act License PyPI

Multi-regime AI incident classification + reporting MCP (EU AI Act Art 73, DORA, NIS2, GDPR breach)

Multi-regime AI incident classification + reporting MCP (EU AI Act Art 73, DORA, NIS2, GDPR breach). MIT


🚀 Quick Start

# Install via pip
pip install ai_incident_reporting_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install ai-incident-reporting-mcp --client claude

Related MCP server: DORA Compliance MCP

✨ Features

  • Article 73 incident reporting

  • 5-clock broadcast

  • Escalation workflows

  • Audit trail

  • Regulatory submission

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo — Full MCP suite + EU AI Act tracking

  • Enterprise: $499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

meok.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

📜 License

MIT © CSOAI-ORG


Full catalogue + Anthropic Registry verify links: meok.ai/anthropic-registry

Protocol coverage + Universal PAYG

This MCP is part of MEOK's 47-MCP fleet that bridges every active agent-interop protocol and 30+ regulatory frameworks. See the full coverage matrix at meok.ai/protocols.

Agent interop protocols supported (8 live):

  • MCP (Anthropic) — native

  • A2A (Google + Linux Foundation, absorbed IBM ACP Sept 2025)

  • IBM ACP — covered via A2A merge

  • Stripe ACP (Agentic Commerce Protocol) — Q3 bridge via agent-commerce-protocol-mcp

  • AP2 (Google Agent Payments) — partial via agent-commerce-payments-mcp

  • x402 (Coinbase HTTP 402) — partial via api.meok.ai gateway

  • OASF / AGNTCY (Cisco Outshift + Linux Foundation) — Q3 bridge

  • 👁 ANP (Cisco Agent Network) — watch-list

Pricing options:

Option

Price

Best for

Self-host (this MCP)

£0 — MIT

Devs

This MCP Starter

£29/mo

One-MCP teams

This MCP Pro

£79/mo

Production + 24h SLA

Universal PAYG

£29/mo + £0.0002/call

Spiky usage across many MCPs

Substrate bundle (this category)

£99-£499/mo

A whole pack

MEOK Universe

£1,499/mo

All 47 MCPs, 500K calls

Each tier above the free self-host adds HMAC-signed attestations verifiable at verify.meok.ai. Linux Foundation governance on the A2A spine means EU regulated buyers can deploy without vendor-lock-in objections.

💸 Try MEOK in 30 seconds — instant buy ladder

Tier

Price

What you get

Stripe

Smoke test

£1

Signed sample MCP-Hardening report + Article 50 PDF

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Quick Kit

£9

EU AI Act Article 50 implementation guide (C2PA + EU-Icon)

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Founder Call

£29

30-min 1-on-1 with the founder

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Configuration

Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:

{
  "mcpServers": {
    "ai-incident-reporting-mcp": {
      "command": "uvx",
      "args": ["ai-incident-reporting-mcp"]
    }
  }
}

Or: pip install ai-incident-reporting-mcp then run the ai-incident-reporting-mcp command (stdio transport).

Examples

Once configured, ask your assistant, for example:

  • "Use classify_incident to …"

  • "Use list_regime_clocks to …"

  • "Use sign_incident_response_attestation to …"

See also

MEOK compliance MCP fleet: meok-eu-ai-act-art-26-fria-mcp, nis2-compliance-mcp

Available Tools

3 tools
classify_incidentB

Classify an incident against every regime in scope. Returns the multi-regime decision tree: which clocks start, who to notify, on what form, by when.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_typeYes
incident_descriptionYes
affected_people_countNo
duration_hoursNo
economic_impact_eurNo
personal_data_breachedNo
cross_borderNo
is_high_risk_aiNo
is_financial_entityNo
is_nis2_entityNo
is_iso42001_certifiedNo
is_frontier_model_developerNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It states what the tool returns but does not disclose side effects (e.g., whether it modifies state), authentication needs, rate limits, or error behavior. The mention of 'which clocks start' hints at possible side effects, but it is ambiguous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences that convey purpose and output without extraneous text. However, it could benefit from a more structured format to highlight key points.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 parameters and no param descriptions, the description is insufficient for proper use. It fails to explain which regimes are in scope, how inputs affect classification, or provide examples. An output schema exists but is not described, so the agent cannot infer return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. However, it does not explain any parameters or their expected values. Parameter titles are somewhat clear, but without description, an agent may misinterpret fields like entity_type or incident_description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'classify', the resource 'incident', and the scope 'against every regime in scope'. It also specifies the output as a multi-regime decision tree with details on clocks, notifications, etc. This distinguishes it from siblings like list_regime_clocks and sign_incident_response_attestation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives. While the purpose is clear, there is no mention of prerequisites, when not to use it, or how it relates to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_regime_clocksB

List the reporting clocks + authorities for every regime this MCP covers.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions 'reporting clocks + authorities' but gives no details about read-only nature, authentication requirements (api_key optional but unexplained), rate limits, or side effects. The description fails to add sufficient behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise at one sentence, front-loading the verb and object. Every word earns its place. However, it could be slightly expanded without harming conciseness to cover parameter usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists (not shown), the description need not detail return values. However, it lacks context about what 'regimes' are, prerequisites for the optional api_key, and any behavioral caveats. For a simple list tool, the coverage is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter (api_key) with 0% description coverage. The tool description does not mention the parameter, its purpose, or when to provide it. The description adds no meaning beyond the schema's bare structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List') and the resource ('reporting clocks + authorities') with explicit scope ('every regime this MCP covers'), effectively differentiating it from sibling tools like classify_incident and sign_incident_response_attestation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives, but the tool's name and description make its purpose clear enough given the distinct siblings. A statement about prerequisites or context would improve the score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_incident_response_attestationC

Generate a cryptographically signed AI incident-response attestation (Pro+).

Captures: which regimes were notified, within which SLAs, what the response score was. Auditors consume the verify_url as evidence of post-incident compliance.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_nameYes
incident_idYes
response_scoreYes
regimes_notified_csvNo
findings_csvNo
include_pdf_base64No
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states it generates a signed attestation and captures specific data, but does not disclose authentication needs, potential side effects, error behaviors, or whether it requires special permissions. The mention of 'Pro+' hints at licensing but is vague.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences plus a bullet-style list, concise and to the point. It avoids unnecessary detail, but could benefit from slightly better structure to separate what it does from what it captures.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters, no schema descriptions, no annotations, and an output schema, the description is insufficient. It covers high-level purpose and output but fails to explain parameter semantics, usage context, or how it fits with siblings, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 7 parameters with 0% description coverage, and the tool description does not mention any parameter. This leaves the meaning of each parameter entirely unclear, forcing agents to guess.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a signed attestation for incident response, specifying it captures regimes notified, SLAs, and response score. This distinguishes it from classification (classify_incident) and listing (list_regime_clocks), but does not explicitly differentiate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use after incident response for compliance evidence, but gives no explicit when-to-use or when-not-to-use guidance, nor any mention of alternatives like classify_incident or list_regime_clocks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.1.2
    • First observedclassify_incident
    • First observedlist_regime_clocks
    • First observedsign_incident_response_attestation

TDQS

B3.4/5.0

Scored across 3 tools

Disambiguation5/5

Each tool targets a distinct operation: classification, listing clocks, and signing attestations. No overlap or ambiguity.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case, making them predictable and easy to distinguish.

Tool Count4/5

Three tools is slightly lean but appropriate for the narrow domain of AI incident reporting compliance. Each tool serves a clear purpose without redundancy.

Completeness5/5

The toolset covers the full workflow: classification against regimes, awareness of reporting clocks, and generation of signed attestations for auditors. No obvious gaps.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers