MEOK DORA Tlpt Planner MCP
meok-dora-tlpt-planner-mcp
DORA 第 26 条威胁导向渗透测试 (TLPT) 规划器 — 提供 TIBER-EU 路径范围界定、白队 RACI、威胁情报简报模板以及 HMAC 签名的合规性证明。
由 MEOK AI Labs 开发 · MIT 许可证 · 可作为 MCP 服务器 在 Claude Code、Cursor、Cline、Windsurf 等工具中运行。
为什么存在此工具
DORA 法规 (EU) 2022/2554 第 26-27 条要求重要/系统性金融实体每三年使用经认可的红队提供商并遵循 TIBER-EU 框架进行威胁导向渗透测试 (TLPT)。
目前,TLPT 业务的最低成本为 25-50 万欧元(3-8 万欧元的威胁情报报告 + 10-50 万欧元的红队测试 + 10-50 万欧元的补救储备金)。希望为监管机构检查做好准备的非重要机构目前缺乏入门级路径。
此 MCP 为您提供免费的范围界定 + 规划层,采用 MIT 许可证,可由任何 AI 代理调用,并提供监管机构可进行加密验证的 HMAC 签名证明。
它不取代经认可的红队提供商。它压缩了目前占用 TLPT 咨询费用 30-40% 的规划、RACI 和补救跟踪阶段。
Related MCP server: Planthire AI MCP
工具
工具 | 用途 |
| 生成包含阶段计划、RACI、红队提供商要求、预算分级的 DORA 第 26 条范围文档 |
| 制作符合 TIBER-EU v2.0 标准的 TTI 简报模板,以委托经认可的威胁情报提供商 |
| 包含严重性映射关闭时间表的 90/180/365 天补救计划 (第 26(7) 条) |
| 通过 |
| 列出包含交付成果的 3 个 TIBER-EU 阶段(准备/测试/结束) |
| 定价层级(免费 / 79 英镑专业版 / 1,499 英镑企业版 / 5,000 英镑起定制版) |
安装
pip install meok-dora-tlpt-planner-mcp然后添加到您的 Claude Code / Cursor / Cline MCP 配置中:
{
"mcpServers": {
"meok-dora-tlpt-planner": {
"command": "python",
"args": ["-m", "meok_dora_tlpt_planner"]
}
}
}使用示例
在 Claude Code 中:
"为 Acme Bank N.V. 规划 DORA TLPT,这是一家在德国、荷兰、爱尔兰运营的信贷机构。关键职能:零售支付、核心银行、客户入职。上次 TLPT 时间为 2023-06-15。年度预算估算 75 万欧元。"
Claude 调用 scope_tlpt(...),返回包含阶段计划、RACI、红队提供商要求和预算分级的结构化范围文档。您进行审查、更正,使用 signed_tlpt_attestation() 签名,并交给您的白队负责人。
"为 47 个发现生成 90/180/365 补救里程碑计划:3 个严重,11 个高,23 个中,10 个低。"
Claude 返回一个结构化的里程碑计划,其中包含根据 DORA 第 26(7) 条制定的严重性映射关闭时间表。
合规性态势
DORA 法规 (EU) 2022/2554 第 26-27 条 (TLPT)
DORA 关于 TLPT 的 RTS (根据第 26(11) 条 — 2024 年通过最终 RTS)
TIBER-EU 框架 v2.0 (欧洲央行,2023 年 8 月更新)
MITRE ATT&CK 企业版 + ICS (用于 TTI 简报中的 TTP 映射)
ICD-203 归因置信度声明标准
定价
免费 — 完整工具集,公共证明 API (共享 HMAC 颁发者)
79 英镑/月 专业版 — 您自己的 HMAC 签名密钥 + 自定义验证域
1,499 英镑/月 企业版 — 用于集团级协调的多业务单元隔离 + SLA
5,000 英镑起 定制版 — 自托管证明 API + GRC 集成 + 现场培训
购买:https://meok.ai/pricing · 联系:nicholas@csoai.org
经销商/咨询合作伙伴
如果您是从事 TLPT 业务的四大/精品咨询公司,MEOK 为专业版提供 70/30 的经销商分成。您可以为您的客户贴牌使用。发送电子邮件至 nicholas@csoai.org,主题为 "TLPT reseller inquiry"。
许可证
MIT。© 2026 Nicholas Templeman / CSOAI LTD (英国公司注册处 16939677)。
另请参阅
meok-dora-compliance-mcp — 更广泛的 DORA 合规工具包(第 28 条登记册,第 18 条事件报告)
meok-attestation-api — 公共可验证证明基础设施
Available Tools
6 toolslist_phasesA
List the 3 TIBER-EU TLPT phases with deliverables.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It correctly indicates a read-only listing operation with no side effects. No further behavioral details (e.g., auth) are needed given the tool's simplicity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence of 8 words, front-loaded with action ('List'), no wasted words. Perfect conciseness and clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a simple list tool with 0 parameters and an output schema. The description covers what is listed (3 phases, deliverables) and no additional context is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description does not add parameter-specific information, but none is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists 'the 3 TIBER-EU TLPT phases with deliverables,' using a specific verb and resource. It distinguishes from siblings like pricing or scope_tlpt, which cover different TIBER-EU aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use or avoid this tool vs alternatives. However, the set of siblings are distinct, so usage is implied for listing phases, but lack of explicit context lowers the score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pricingC
Pricing for MEOK DORA TLPT Planner.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose any behavioral traits such as side effects, permissions, or rate limits. The agent has no insight into whether the tool is read-only or requires special access.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundancy, making it concise. However, it is so brief that it sacrifices necessary detail, which prevents a higher score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters and an output schema present, the description should explain what pricing information is returned (e.g., costs, tiers, or conditions). It fails to do so, leaving the agent without sufficient context to trust the tool's relevance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so baseline is 4. However, the description ('Pricing...') does not add value beyond the empty schema—it merely restates the tool name. It could describe the output structure or content, which is absent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Pricing for MEOK DORA TLPT Planner,' indicating this tool provides pricing information. It distinguishes from sibling tools (e.g., list_phases, scope_tlpt) by focusing on pricing. However, it lacks a specific verb (e.g., 'get' or 'retrieve'), which would improve precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of context, prerequisites, or exclusions, leaving the agent to guess its appropriate role.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remediation_milestonesA
Generate a 90/180/365-day remediation milestone plan based on TLPT findings.
Args: findings_count: Total number of findings from the red-team report. severity_distribution: Dict with keys 'critical', 'high', 'medium', 'low' and counts.
Returns: Milestone plan with required closure timelines per severity.
| Name | Required | Description | Default |
|---|---|---|---|
| findings_count | Yes | ||
| severity_distribution | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must disclose behavioral traits. It explains the output (a milestone plan with closure timelines) but does not mention side effects, authentication needs, or read-only nature. It is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose line followed by Args and Returns sections. It is efficient and front-loaded, though could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters, output schema exists), the description covers inputs and output sufficiently. It provides a complete picture for usage without needing additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description adds significant meaning by explaining 'findings_count' as total findings and 'severity_distribution' as a dict with keys like critical, high, etc. This compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Generate a 90/180/365-day remediation milestone plan based on TLPT findings.' It uses a specific verb ('Generate') and specifies the resource and context, distinguishing it from siblings like list_phases or pricing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for generating plans from TLPT findings but does not explicitly state when to use this tool over alternatives, nor does it provide exclusionary guidance. Adequate but lacks comparative context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scope_tlptA
Generate a DORA Article 26 TLPT scope document for a financial entity.
Args: entity_name: Legal name of the financial entity (e.g., "Acme Bank N.V."). entity_type: One of credit-institution / investment-firm / insurance / pension-fund / payment-institution / e-money-institution / market-infrastructure / CCP. sector: ISIC sector code (default: credit-institution). critical_functions: List of critical/important functions to be scoped (per Art. 26(2)). E.g., ["retail-payments", "trading-platform", "customer-onboarding"]. last_tlpt_date: ISO date of last TLPT (YYYY-MM-DD) — DORA mandates 3-year cycle. annual_budget_estimate_eur: Estimated TLPT engagement budget (drives RT-provider tier).
Returns: Structured scope document with phase plan, deliverables, RACI, and budget breakdown.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_name | Yes | ||
| entity_type | Yes | ||
| sector | No | credit-institution | |
| critical_functions | No | ||
| last_tlpt_date | No | ||
| annual_budget_estimate_eur | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool returns a structured scope document and outlines its contents (phase plan, deliverables, RACI, budget breakdown). This provides clear behavioral expectations, though it could explicitly confirm no side effects or authorization needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections, and each sentence adds value. It is moderately concise, though the parameter explanations could be slightly more compact without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, 2 required, has output schema), the description covers all parameters and the return value comprehensively. It provides sufficient context for an agent to invoke the tool correctly without ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates by explaining each parameter in detail (e.g., allowed values for entity_type, default for sector, purpose of critical_functions, format for last_tlpt_date). This adds significant meaning beyond the schema's property names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Generate a DORA Article 26 TLPT scope document for a financial entity', a specific verb+resource. Sibling tools (list_phases, pricing, etc.) address different use cases, so this tool is well-distinguished.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context (generating a TLPT scope document) but does not explicitly state when to use this tool versus alternatives like pricing or threat_intel_brief. No exclusion criteria or guidance on when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
signed_tlpt_attestationA
Produce an HMAC-signed TLPT attestation via the public meok-attestation-api.
Args: entity_name: Legal name of the financial entity. scope_summary: 1-3 sentence summary of test scope. test_phase: One of preparation / testing / closure. findings_summary: Dict with findings_count, severity_distribution, and summary text. signing_role: Role of the signer (default white-team-lead).
Returns: Signed attestation with verification URL.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_name | Yes | ||
| scope_summary | Yes | ||
| test_phase | Yes | ||
| findings_summary | Yes | ||
| signing_role | No | white-team-lead |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It indicates the action produces a signed attestation but does not disclose side effects, authorization requirements, or whether the action is idempotent. This is insufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a one-line purpose followed by a bullet-like list of arguments. It front-loads the purpose and uses no filler, but could be more structured (e.g., markdown formatting).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all input parameters and mentions the return value. However, it lacks constraints (e.g., signing_role values beyond the default) and does not explain the output schema in detail. The output schema exists but is not leveraged.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds significant meaning: it explains the expected structure of findings_summary (dict with specific keys), lists enum values for test_phase, and notes the default for signing_role. This goes beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool produces an HMAC-signed TLPT attestation via a specific API, and lists all arguments. It is distinct from sibling tools like list_phases or pricing, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a signed attestation is needed, but does not explicitly state when to use this tool versus alternatives or provide any exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threat_intel_briefA
Generate a Targeted Threat Intelligence (TTI) brief template per ECB TIBER-EU v2.0.
This is a SCAFFOLD. Real TTI must be authored by an accredited threat-intel provider with current intelligence feeds. Use this template to brief them.
Args: entity_name: Legal name of the financial entity. entity_sector: One of retail-banking, wholesale-banking, insurance, asset-management, market-infrastructure, payments, e-money. geographic_footprint: List of country codes where entity operates (e.g., ["DE", "NL", "IE"]). critical_functions: List of critical functions for which threats must be modelled.
Returns: TTI template with sections aligned to TIBER-EU + ECB standards.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_name | Yes | ||
| entity_sector | Yes | ||
| geographic_footprint | Yes | ||
| critical_functions | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose any behavioral traits such as side effects, permissions, rate limits, or whether it is read-only. It only explains the scaffold nature but lacks essential behavioral context for a tool with no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with four sentences plus a parameter list. It front-loads the purpose and scaffold note, and every sentence is valuable. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists (but not shown), the description mentions the template aligns with standards. It explains all parameters adequately. However, it lacks details on error handling or behavior for invalid inputs, but overall is fairly complete for a template generator.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description fully compensates by explaining each parameter: entity_name is legal name, entity_sector lists allowed values, geographic_footprint expects country codes, and critical_functions are for threat modeling. This adds significant meaning beyond the schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a TTI brief template per ECB TIBER-EU v2.0, specifies it's a scaffold, and distinguishes it from siblings which are unrelated (e.g., list_phases, pricing). The verb 'Generate' and resource 'TTI brief template' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the template is a scaffold and that real TTI must be authored by an accredited provider, guiding users to use it for briefing providers. It does not explicitly mention when not to use or alternative tools, but the context is clear enough for a template generator.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.3- First observed
list_phases - First observed
pricing - First observed
remediation_milestones - First observed
scope_tlpt - First observed
signed_tlpt_attestation - First observed
threat_intel_brief
TDQS
Scored across 6 tools
Each tool targets a distinct purpose: listing phases, pricing, remediation milestones, scope document generation, signed attestation, and threat intel brief. No overlap in functionality, making selection unambiguous.
Names use snake_case but mix verb_noun (list_phases, signed_tlpt_attestation) with plain nouns (pricing, remediation_milestones, scope_tlpt, threat_intel_brief). While readable, the pattern is inconsistent.
With 6 tools, the server covers the key planning activities for DORA TLPT without being bloated or sparse. Each tool contributes meaningfully to the planner's purpose.
The set covers phases, pricing, remediation, scope, attestation, and threat intel scaffolding. A minor gap is the lack of a tool to input findings automatically, but the remediation_milestones tool accepts that data, so the core workflow is intact.
Maintenance
Related MCP Connectors
Agent Delegation MCP Server by MEOK AI Labs
Agent Orchestrator MCP Server by MEOK AI Labs
MCP server for AI dialogue using various LLM models via AceDataCloud
MCP server for Flux AI image generation
Related MCP Servers
- AlicenseAqualityCmaintenanceMEOK Fria Generator - MCP server providing AI-powered tools and automation by MEOK AI Labs7MIT
- AlicenseAqualityCmaintenancePlanthire AI - MCP server providing AI-powered tools and automation by MEOK AI Labs73 npm35 PyPIMIT
- AlicenseNot gradedqualityBmaintenanceEvent Planning AI - MCP server providing AI-powered tools and automation by MEOK AI Labs3 npm33 PyPIMIT
- AlicenseNot gradedqualityCmaintenanceMEOK Omnibus Tracker - MCP server providing AI-powered tools and automation by MEOK AI LabsApache 2.0