Skip to main content
Glama
CSOAI-ORG

CRA Compliance MCP

cra-compliance-mcp MCP 서버 MCP 레지스트리 PyPI

cra-compliance-mcp MCP 서버

PyPI 다운로드 GitHub 스타 라이선스: MIT

CRA 규정 준수 MCP

디지털 요소가 포함된 제품에 대한 EU 사이버 복원력 법(Regulation 2024/2847) 준수 자동화.

제조업체 · 수입업체 · 유통업체 · 오픈소스 관리자

전면 적용: 2027년 12월 11일. 벌금: 최대 1,500만 유로 또는 전 세계 매출액의 2.5%.

MEOK AI Labs

설치 · 도구 · 가격


이 도구가 필요한 이유

CRA는 소프트웨어, IoT 장치, 산업용 컨트롤러, SaaS 플랫폼 등 EU에서 판매되는 디지털 요소가 포함된 모든 제품에 적용됩니다. 제조업체는 설계 단계부터 보안을 보장하고, 24시간 이내에 취약점을 처리하며, 10년 동안 기술 문서를 유지해야 합니다. 상업적으로 사용되는 오픈소스 프로젝트의 경우, 의무 사항이 완화된 새로운 "오픈소스 관리자" 범주가 신설되었습니다.

이 MCP는 귀하의 제품을 CRA 범주에 따라 분류하고, 필수 보안 요구 사항을 평가하며, 취약점 처리 프로세스를 점검하고, 적합성 문서를 생성합니다.

Related MCP server: EU AI Act Compliance MCP

설치

pip install cra-compliance-mcp

도구

도구

CRA 참조

기능

classify_product

제6-8조

제품 범주 분류 (기본/중요/핵심)

assess_security_requirements

부속서 I

필수 사이버 보안 요구 사항 점검

check_vulnerability_handling

제14조

24시간 취약점 공개 대응 준비 상태

generate_documentation

부속서 VII

기술 문서 생성기

assess_supply_chain

제13조

소프트웨어 자재 명세서(SBOM) + 종속성 감사

check_open_source_obligations

제25조

오픈소스 관리자 의무 사항

run_full_audit

전체

전체 CRA 준비 상태 평가

sign_attestation

—

HMAC-SHA256 서명된 준수 인증서

주요 일정

이정표

날짜

발효일

2024년 12월 10일

취약점 보고 의무

2026년 9월 11일

전면 적용

2027년 12월 11일

가격

등급

가격

혜택

무료

£0

일일 10회 호출

Pro

£199/월

무제한 + HMAC 서명된 증명서

Enterprise

£1,499/월

멀티 테넌트 + 공동 브랜드 보고서

Pro 구독 · Enterprise

증명 API

POST https://meok-attestation-api.vercel.app/sign
GET  https://meok-attestation-api.vercel.app/verify/{cert_id}

참고: 상세한 부속서 IV 필수 요구 사항은 CRA 부속서 IV 분류기 MCP를 확인하세요.

링크

라이선스

MIT

Available Tools

7 tools
audit_annex_iA

Audit Annex I essential cybersecurity requirements (both Part 1 product properties and Part 2 vulnerability handling) against your current controls.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: product_description (str): The product description to analyze or process. current_controls (str): The current controls to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
product_descriptionYes
current_controlsNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description includes a comprehensive Behavioral Transparency section covering side effects (read-only), authentication, rate limits, error handling, idempotency, and data privacy. Since no annotations are provided, the description fully carries the burden and does so excellently with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Behavior, When to use, When NOT to use, Args, Behavioral Transparency). It is somewhat verbose but not excessive. Could be slightly more concise, but the organization compensates.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 params, no schema descriptions, but has output schema), the description covers all relevant aspects: purpose, usage, behavior, error handling, and privacy. It leaves no critical gaps for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% description coverage. The description lists each parameter with a brief phrase (e.g., 'The product description to analyze or process.'). This adds some meaning beyond the title but lacks details on format, constraints, or examples. With low schema coverage, the description should provide more guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool audits Annex I essential cybersecurity requirements against current controls, with specific detail on Part 1 and Part 2. It distinguishes from siblings like classify_product and enforcement_status by focusing on compliance auditing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (assess, audit, verify compliance) and when NOT to use (not legal advice). Provides context for gap analysis and readiness checks. Lacks direct comparison to sibling tools, but the usage guidance is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

classify_productA

Classify a product with digital elements (PDE) into its CRA class (default/I/II/critical) and return the conformity assessment path + essential requirements scope.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: product_description (str): The product description to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
product_descriptionYes
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and delivers a thorough 'Behavioral Transparency' section covering side effects (read-only), authentication, rate limits, error handling, idempotency, and data privacy. This exceeds expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Behavior, When to use, Args, Behavioral Transparency). Slightly verbose but each section earns its place. Could be shorter by merging some parts, but overall acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 params, 1 required) and the presence of an output schema, the description fully covers purpose, behavior, and usage. No gaps identified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description barely adds to parameter meaning. For product_description, it only says 'to analyze or process', which is vague and restates the name. api_key similarly generic. No examples or format hints. Should provide more context for a 0% coverage tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool classifies a product with digital elements (PDE) into its CRA class and returns the conformity assessment path and essential requirements scope. This clearly distinguishes it from sibling tools like audit_annex_i or conformity_assessment_roadmap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides dedicated 'When to use' and 'When NOT to use' sections, guiding the agent to use the tool for compliance assessment, gap analysis, and documentation generation, while cautioning against substituting for legal advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

conformity_assessment_roadmapA

Produce a conformity assessment roadmap for CE marking your product under CRA.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: product_class (str): The product class to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
product_classYes
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and exceeds expectations, detailing side effects (read-only), authentication, rate limits, error handling, idempotency, and data privacy. This is comprehensive and transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but well-structured with clear headings and bullet points. The first sentence effectively front-loads the purpose. Minor redundancy in the behavioral section could be trimmed without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and existence of an output schema, the description covers all essential aspects: purpose, usage, behavior, parameters (though weak). It addresses authentication, rate limits, and data privacy, leaving minimal gaps except parameter semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description's 'Args' section merely restates parameter names and types without adding constraints, examples, or semantic detail. For product_class, it says 'The product class to analyze or process,' which is too generic to be helpful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Produce a conformity assessment roadmap for CE marking your product under CRA,' clearly identifying the verb (produce), resource (roadmap), and context (CE marking). This distinguishes it from siblings like audit_annex_i or classify_product.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance: use for compliance assessment, gap analysis, readiness checks; not as legal advice. This effectively differentiates from alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enforcement_statusA

Current CRA enforcement timeline + key deadlines.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description includes a dedicated 'Behavioral Transparency' section covering side effects, authentication, rate limits, error handling, idempotency, and data privacy. This is thorough and goes beyond basic requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections and front-loaded with core purpose. It is somewhat lengthy but each sentence adds value. Minor redundancy between 'Behavior' and 'Behavioral Transparency' sections but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Contextual completeness is high given the output schema exists. The description covers rate limits, authentication, error handling, idempotency, and privacy, addressing all likely agent concerns. The single optional parameter is adequately explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the only parameter 'api_key' is described as 'The api key to analyze or process.' This adds some meaning beyond the schema's type and default but is minimal. A baseline of 3 is appropriate given the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Current CRA enforcement timeline + key deadlines' providing a specific verb+resource. It distinguishes from sibling tools which focus on classification, auditing, and attestation. Title is missing, which slightly reduces clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance on appropriate contexts and alternatives, including a warning against substituting legal advice. This fully meets the criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sbom_skeletonA

Generate a minimal CycloneDX-style SBOM skeleton required for CRA Article 13. Pass components as a comma-separated list or JSON; Pro tier auto-scans dependencies.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: product_name (str): The product name to analyze or process. components (str): The components to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
product_nameYes
componentsNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully assumes the burden of disclosing behavioral traits. It includes a dedicated section covering side effects (read-only), authentication (none for basic), rate limits (10/day free), error handling (structured objects), idempotency (fully deterministic), and data privacy (no storage). This is comprehensive and model-friendly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Behavior, When to use, Args, Behavioral Transparency) and front-loads the main purpose. While somewhat verbose, every sentence contributes meaning. It could be slightly more concise, but remains readable and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists (context signal), the description does not need to detail return values. It covers error handling, rate limits, auth, and idempotency—sufficient for a 3-parameter tool with one required. The weak parameter descriptions are a minor gap, but overall completeness is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. However, the 'Args' section merely repeats parameter names with generic phrases like 'The product name to analyze or process.' The tool's main description mentions 'comma-separated list or JSON' for components but does not link this to the parameter itself. This adds minimal semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a minimal CycloneDX-style SBOM skeleton for CRA Article 13, distinguishing it from sibling tools like audit_annex_i or classify_product. The verb 'Generate' and specific resource 'SBOM skeleton' leave no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'When to use' and 'When NOT to use' sections, guiding the agent to compliance assessment and gap analysis while cautioning against substituting legal advice. However, it lacks explicit differentiation from sibling tools, limiting its helpfulness in tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_cra_attestationA

Generate a cryptographically signed CRA (Cyber Resilience Act) compliance attestation (Pro/Enterprise).

Uses the shared MEOK attestation module — HMAC-SHA256 signed JSON + public verify URL

  • optional board-ready PDF. Auditors validate via verify_url without backend access. Expires 365 days from issue.

  • findings_csv: comma-separated findings (e.g. "Annex I.1 cybersecurity-by-design PASS,Annex I.2 vulnerability handling GAP")

  • requirements_audited_csv: comma-separated Annex I requirement IDs (e.g. "1,2,3")

  • include_pdf_base64: True to receive PDF as base64

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_nameYes
overall_scoreYes
findings_csvNo
requirements_audited_csvNo
include_pdf_base64No
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the cryptographic method (HMAC-SHA256), the output (signed JSON + verify URL + optional PDF), and expiration (365 days). It does not mention error handling or required permissions, but overall provides adequate transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a lead sentence summarizing purpose and bullet points for parameters. It is front-loaded and efficient, though the bullet format is acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the output format and key parameter details but misses explanations for two required parameters and api_key. With an output schema existing, the missing parameter info reduces completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains three parameters (findings_csv, requirements_audited_csv, include_pdf_base64) but leaves entity_name, overall_score, and api_key undocumented. Given 0% schema coverage, this is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it generates a signed CRA compliance attestation, specifying the verb 'generate' and the resource. This distinguishes it from sibling tools like audit_annex_i or classify_product, which have different functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use the tool (for generating signed attestations) and explains the output format and expiration. However, it lacks explicit guidance on when not to use it or alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vulnerability_reporting_readinessA

Check readiness for the Sep 2026 mandatory reporting of exploited vulnerabilities + severe incidents under CRA Article 14 (single reporting platform via ENISA).

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: product_description (str): The product description to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
product_descriptionYes
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It provides a detailed 'Behavioral Transparency' section covering read-only, stateless, idempotency, authentication, rate limits (free/pro tiers), error handling, and data privacy. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections (purpose, behavior, when to use, args, behavioral transparency). Front-loaded with key purpose. However, the 'Args' section is weak and redundant, and the behavioral transparency section could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, and behavioral aspects thoroughly. Parameter semantics are incomplete, but output schema exists (not shown) so return values may be documented elsewhere. Missing a brief note on output type or format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must compensate. However, the 'Args' section only restates parameter names and types ('product_description (str)', 'api_key (str)') without adding format, constraints, examples, or additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks readiness for mandatory reporting under CRA Article 14, with specific verb ('Check') and resource ('readiness for Sep 2026 mandatory reporting'). This distinguishes it from sibling tools like audit_annex_i or classify_product.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear context for assessment, audit, gap analysis, and compliance documentation. It advises against using as legal advice. However, no explicit mention of sibling tools as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv1.2.6
    • First observedaudit_annex_i
    • First observedclassify_product
    • First observedconformity_assessment_roadmap
    • First observedenforcement_status
    • First observedsbom_skeleton
    • First observedsign_cra_attestation
    • First observedvulnerability_reporting_readiness

TDQS

A4.2/5.0

Scored across 7 tools

Disambiguation5/5

Each tool serves a distinct compliance function (audit, classification, roadmap, timeline, SBOM, attestation, reporting readiness) with no overlapping purposes, making it easy for agents to select the correct tool.

Naming Consistency3/5

All names use underscore_separated words but mix verb-noun (e.g., audit_annex_i) and noun-noun patterns (e.g., enforcement_status, sbom_skeleton), showing moderate inconsistency.

Tool Count5/5

7 tools is appropriate for a compliance server covering classification, auditing, roadmap, timelines, SBOM, attestation, and reporting readiness without being overwhelming or insufficient.

Completeness4/5

The tool set covers the main CRA requirements (classification, auditing, roadmap, enforcement info, SBOM, attestation, reporting readiness). A minor gap is the lack of a dedicated vulnerability handling audit tool, but Annex I audit covers it partially.

Maintenance

ActivitySlowing
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers