Skip to main content
Glama

MCP Scorecard: 74/100

mcp-name: io.github.CSOAI-ORG/meok-governance-engine-mcp

Meok Governance Engine MCP

MEOK AI Labs GSPC License PyPI

Unified AI governance engine MCP — orchestrates 13 regulatory frameworks with signed audit receip...

Unified AI governance engine MCP — orchestrates 13 regulatory frameworks with signed audit receipts and Stripe-tier access.


🚀 Quick Start

# Install via pip
pip install meok_governance_engine_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install meok-governance-engine-mcp --client claude

Related MCP server: AI Gateway MCP

✨ Features

  • MCP protocol compliant

  • Easy installation

  • Well-documented API

  • Production-ready

  • Active maintenance

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo — Full MCP suite + EU AI Act tracking

  • Enterprise: $499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

meok.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

📜 License

MIT © CSOAI-ORG



Pairs with MEOK Governance Suite

Build something that touches users? You need compliance. MEOK ships 38 governance MCPs that drop in alongside this tool — EU AI Act, DORA, NIS2, CRA, GDPR, ISO 42001, FDA SaMD, MDR, Basel, MiFID II, MiCA, COPPA, and more.

# One-shot install of the governance pack
npx meok-setup --pack governance

Free tier: 10 calls/day per MCP. Pro tier (£79/mo): unlimited + cryptographically signed compliance attestations your auditor verifies independently.

→ Full catalogue: councilof.ai/catalogue → MEOK AI Labs: meok.ai

💸 Try MEOK in 30 seconds — instant buy ladder

Tier

Price

What you get

Stripe

Smoke test

£1

Signed sample MCP-Hardening report + Article 50 PDF

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Quick Kit

£9

EU AI Act Article 50 implementation guide (C2PA + EU-Icon)

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Founder Call

£29

30-min 1-on-1 with the founder

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Available Tools

6 tools
compliance_cost_estimatorA

Estimate compliance costs and show how MEOK Governance Engine saves money.

Compares: doing it yourself vs consulting firm vs MEOK automated tools.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: systems_count (int): The systems count to analyze or process. risk_level (str): The risk level to analyze or process. current_certifications (str): The current certifications to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo
risk_levelNohigh
systems_countNo
current_certificationsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Detailed 'Behavioral Transparency' section covers side effects, authentication, rate limits, error handling, idempotency, and data privacy. Exceeds requirements, especially with no annotations provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with sections (purpose, behavior, when to use, args, transparency). Front-loaded with key info. Some redundancy in args section, but overall each part adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers behavior, usage, and transparency thoroughly. Missing specifics about output format despite an output schema being present. Parameter descriptions are weak, but overall context is rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage. The 'Args' section merely repeats parameter names with generic phrases like 'The systems count to analyze or process', adding no real semantics. Does not explain valid values or formats beyond defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool estimates compliance costs and compares DIY vs consulting vs MEOK. Distinguishes itself from siblings like 'compliance_score_engine' by focusing on cost comparison.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (assess, audit, verify) and when NOT to use (not legal advice). Could improve by naming alternative sibling tools for specific tasks, but provides clear context otherwise.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_score_engineA

Calculate compliance percentage per framework. Input system description, get scored breakdown.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: system_description (str): The system description to analyze or process. frameworks (str): The frameworks to analyze or process. nist: The nist to analyze or process. iso_42001": The iso 42001" to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo
frameworksNoeu_ai_act,nist,iso_42001
system_descriptionYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It comprehensively covers read-only, stateless, idempotent behavior, rate limits (free/pro tiers), authentication requirements, error handling, and data privacy. This fully informs the agent of the tool's behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and contains redundancy (Behavior and Behavioral Transparency sections overlap). The Args section includes non-existent parameters. While front-loaded with purpose, it could be more streamlined and accurate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (3 params, output schema present), the description covers purpose, usage, behavior, and most parameter semantics. However, parameter inaccuracies and lack of output structure explanation (though output schema exists) reduce completeness. It is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must compensate. While it describes 'system_description' and 'frameworks', it erroneously lists additional parameters 'nist' and 'iso_42001' that do not exist in the schema, causing confusion. The api_key description is vague. Overall, the description adds partial value but with significant inaccuracies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool calculates compliance percentage per framework, with explicit use cases like gap analysis and readiness checks. It distinguishes itself from siblings (e.g., compliance_cost_estimator, which_frameworks_apply) by specifying its unique function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'When to use' section listing appropriate scenarios (e.g., compliance assessment, audit, verification) and a 'When NOT to use' section clarifying it is not a substitute for legal advice. This provides clear guidance on appropriate and inappropriate tool usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

full_governance_reportA

Generate a COMPLETE multi-framework governance report in one call.

Runs EU AI Act risk classification, NIST risk profile, ISO 42001 audit, GDPR assessment, and crosswalk analysis — all at once. The enterprise single-call solution.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: system_name (str): The system name to analyze or process. system_description (str): The system description to analyze or process. jurisdictions (str): The jurisdictions to analyze or process. us: The us to analyze or process. uk": The uk" to analyze or process. use_case (str): The use case to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo
use_caseNo
system_nameYes
jurisdictionsNoeu,us,uk
system_descriptionYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It includes a dedicated 'Behavioral Transparency' section detailing side effects (read-only, no modifications), authentication (none for basic, API key for pro), rate limits (10/day free, unlimited pro), error handling (structured errors), idempotency, and data privacy. This is comprehensive and adds significant value beyond typical disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, behavioral, when to use/not, args, behavioral transparency). It is front-loaded with the main purpose. Some redundancy exists (e.g., read-only stated twice), but overall it is concise and organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multi-framework report) and 5 parameters, the description covers authentication, rate limits, error handling, and idempotency. It does not detail the output structure, but an output schema exists. Parameter descriptions are weak, which slightly reduces completeness. Still, sufficient for an agent to judge usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It includes an 'Args' section with one-line descriptions for each parameter. However, some descriptions are identical (e.g., system_name and system_description), and there are typos (e.g., 'us' and 'uk' entries have extra quotes). The api_key description is misleading. While it adds some meaning, the quality is uneven, warranting a 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a comprehensive multi-framework governance report covering EU AI Act, NIST, ISO 42001, GDPR, and crosswalk analysis. It uses a specific verb (generate) and resource (report), and is well-differentiated from sibling tools like compliance_score_engine or which_frameworks_apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'When to use' and 'When NOT to use' sections, covering gap analysis, readiness checks, and compliance documentation. It clearly states not to use as substitute for legal counsel. However, it does not explicitly mention sibling tools as alternatives, which would further aid selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_full_audit_trailA

Get timestamped audit trail of all governance checks performed.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: limit (int): The limit to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, stateless, idempotent, rate limits (free and pro), authentication requirements, error handling, data privacy, and safe retryability. This is comprehensive and prevents misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections and front-loaded purpose. However, the 'Behavioral Transparency' section repeats some content from 'Behavior,' making it slightly redundant. Overall efficient but not maximally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description does not need to detail return structure. It covers rate limits, authentication, and error handling. However, it omits a high-level summary of typical audit trail contents (e.g., check names, timestamps), which could aid quick understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The 'Args' section adds no meaningful detail beyond the schema, using vague phrases like 'The limit to analyze or process.' With schema description coverage at 0%, the description should compensate, but it does not clarify data types, constraints, or typical values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get timestamped audit trail of all governance checks performed.' This is a specific verb+resource combination. While it distinguishes itself from sibling tools like compliance_score_engine by focusing on raw audit data, it does not explicitly contrast with alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'When to use' and 'When NOT to use' sections, guiding agents toward compliance auditing and away from legal advice substitution. It provides clear context but does not compare this tool to specific siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_toolsC

List the tools this server actually registers.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose real traits: read-only, stateless, idempotent, no side effects, structured error objects, and rate limits. However, the content is generic boilerplate and internally inconsistent ('No authentication required' alongside 'Pro/Enterprise tiers require a valid MEOK API key'), and it repeats read-only/rate-limit claims across sections.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Header structure exists, but the text is heavily padded with redundant boilerplate: read-only is stated in both 'Behavior' and 'Behavioral Transparency', and rate limits and authentication each appear twice. Much of the length serves a different tool's template rather than this one.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the tool is simple (one optional param). Yet the description is far longer than needed and largely off-topic, leaving the actual contract — what gets listed and how api_key interacts — unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it offers only 'api_key (str): The api key to analyze or process' — a boilerplate line that never explains why a tool-listing operation needs an API key or what it affects. The single parameter is effectively undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line names a specific verb and resource ('List the tools this server actually registers'), which is clear on its own. But the body immediately contradicts it: the 'When to use' section describes compliance auditing, gap analysis, and readiness checks, which is not what a tool-listing tool does. An agent reading the whole description cannot tell whether the tool lists tools or performs compliance analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It does include 'When to use' / 'When NOT to use' sections, but they route the agent to the wrong task — compliance assessment and gap analysis — rather than telling it when to enumerate registered tools versus calling a sibling. The guidance is actively misleading, not merely absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

which_frameworks_applyA

Instantly determine which AI governance frameworks apply to your situation.

Input your country, industry, and AI use case. Get back every applicable framework with enforcement status and deadlines.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: country (str): The country to analyze or process. industry (str): The industry to analyze or process. ai_use_case (str): The ai use case to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo
countryYes
industryNo
ai_use_caseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, stateless, idempotent, rate limits (10/day free, unlimited pro), authentication (none for basic, API key for pro), error handling (structured errors), and data privacy (no storage/logging).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized with sections (Behavior, When to use, Args, Behavioral Transparency), but contains redundancy (e.g., 'read-only' repeated twice) and verbose lists. Could be shortened by 30-40% without losing key details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and 4 params (1 required), the description thoroughly covers behavior, limitations, authentication, rate limits, error handling, idempotency, and privacy. Output schema exists, so return values need no explanation. Highly complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% parameter descriptions. The 'Args' section adds brief descriptions for all 4 parameters (country, industry, ai_use_case, api_key), but they are generic (e.g., 'The country to analyze or process') and lack details on valid values or format. Partially compensates but not highly informative.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool determines applicable AI governance frameworks based on country, industry, and use case. It distinguishes itself from sibling tools like compliance_cost_estimator and full_governance_report by focusing on framework identification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance on appropriate usage for compliance assessment and warn against replacing legal counsel. Also specifies rate limits and authentication requirements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv1.0.0
    • First observedcompliance_cost_estimator
    • First observedcompliance_score_engine
    • First observedfull_governance_report
    • First observedget_full_audit_trail
    • First observedlist_all_tools
    • First observedwhich_frameworks_apply

TDQS

B3.2/5.0

Scored across 6 tools

Disambiguation3/5

Most tools are distinguishable, but compliance_score_engine, full_governance_report, and which_frameworks_apply all perform overlapping compliance analysis, and full_governance_report is explicitly a superset of the others. The 'When to use' text is identical boilerplate across tools, so it gives no real disambiguation help.

Naming Consistency3/5

All names are snake_case, which is good, but the verb style is mixed: list_/get_ are verb-first, while compliance_cost_estimator, compliance_score_engine, and full_governance_report are noun phrases, and which_frameworks_apply is a question. Readable but not a predictable pattern.

Tool Count4/5

Six tools is well-scoped for a governance assessment engine, covering scoring, cost, framework selection, reporting, and audit. Slightly light but each tool maps to a plausible function.

Completeness4/5

The surface covers the core read-only advisory workflow (framework applicability, scoring, cost, full report, audit trail). Minor gaps like no crosswalk-only or remediation-plan tool, and the audit-trail tool contradicts the stated statelessness of the rest.

Maintenance

ActivitySlowing
ResponsivenessSlow

Related MCP Connectors

Related MCP Servers