Skip to main content
Glama

MCP Scorecard: 74/100

mcp-name: io.github.CSOAI-ORG/meok-governance-engine-mcp

Meok Governance Engine MCP

MEOK AI Labs GSPC License PyPI

Unified AI governance engine MCP — orchestrates 13 regulatory frameworks with signed audit receip...

Unified AI governance engine MCP — orchestrates 13 regulatory frameworks with signed audit receipts and Stripe-tier access.


🚀 Quick Start

# Install via pip
pip install meok_governance_engine_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install meok-governance-engine-mcp --client claude

Related MCP server: AI Gateway MCP

✨ Features

  • MCP protocol compliant

  • Easy installation

  • Well-documented API

  • Production-ready

  • Active maintenance

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo — Full MCP suite + EU AI Act tracking

  • Enterprise: $499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

meok.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

📜 License

MIT © CSOAI-ORG



Pairs with MEOK Governance Suite

Build something that touches users? You need compliance. MEOK ships 38 governance MCPs that drop in alongside this tool — EU AI Act, DORA, NIS2, CRA, GDPR, ISO 42001, FDA SaMD, MDR, Basel, MiFID II, MiCA, COPPA, and more.

# One-shot install of the governance pack
npx meok-setup --pack governance

Free tier: 10 calls/day per MCP. Pro tier (£79/mo): unlimited + cryptographically signed compliance attestations your auditor verifies independently.

→ Full catalogue: councilof.ai/catalogue → MEOK AI Labs: meok.ai

💸 Try MEOK in 30 seconds — instant buy ladder

Tier

Price

What you get

Stripe

Smoke test

£1

Signed sample MCP-Hardening report + Article 50 PDF

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Quick Kit

£9

EU AI Act Article 50 implementation guide (C2PA + EU-Icon)

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Founder Call

£29

30-min 1-on-1 with the founder

https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Available Tools

6 tools
compliance_cost_estimatorA

Estimate compliance costs and show how MEOK Governance Engine saves money.

Compares: doing it yourself vs consulting firm vs MEOK automated tools.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: systems_count (int): The systems count to analyze or process. risk_level (str): The risk level to analyze or process. current_certifications (str): The current certifications to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
systems_countNo
risk_levelNohigh
current_certificationsNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Detailed 'Behavioral Transparency' section covers side effects, authentication, rate limits, error handling, idempotency, and data privacy. Exceeds requirements, especially with no annotations provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with sections (purpose, behavior, when to use, args, transparency). Front-loaded with key info. Some redundancy in args section, but overall each part adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers behavior, usage, and transparency thoroughly. Missing specifics about output format despite an output schema being present. Parameter descriptions are weak, but overall context is rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage. The 'Args' section merely repeats parameter names with generic phrases like 'The systems count to analyze or process', adding no real semantics. Does not explain valid values or formats beyond defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool estimates compliance costs and compares DIY vs consulting vs MEOK. Distinguishes itself from siblings like 'compliance_score_engine' by focusing on cost comparison.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (assess, audit, verify) and when NOT to use (not legal advice). Could improve by naming alternative sibling tools for specific tasks, but provides clear context otherwise.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_score_engineA

Calculate compliance percentage per framework. Input system description, get scored breakdown.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: system_description (str): The system description to analyze or process. frameworks (str): The frameworks to analyze or process. nist: The nist to analyze or process. iso_42001": The iso 42001" to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
system_descriptionYes
frameworksNoeu_ai_act,nist,iso_42001
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It comprehensively covers read-only, stateless, idempotent behavior, rate limits (free/pro tiers), authentication requirements, error handling, and data privacy. This fully informs the agent of the tool's behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and contains redundancy (Behavior and Behavioral Transparency sections overlap). The Args section includes non-existent parameters. While front-loaded with purpose, it could be more streamlined and accurate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (3 params, output schema present), the description covers purpose, usage, behavior, and most parameter semantics. However, parameter inaccuracies and lack of output structure explanation (though output schema exists) reduce completeness. It is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must compensate. While it describes 'system_description' and 'frameworks', it erroneously lists additional parameters 'nist' and 'iso_42001' that do not exist in the schema, causing confusion. The api_key description is vague. Overall, the description adds partial value but with significant inaccuracies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool calculates compliance percentage per framework, with explicit use cases like gap analysis and readiness checks. It distinguishes itself from siblings (e.g., compliance_cost_estimator, which_frameworks_apply) by specifying its unique function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'When to use' section listing appropriate scenarios (e.g., compliance assessment, audit, verification) and a 'When NOT to use' section clarifying it is not a substitute for legal advice. This provides clear guidance on appropriate and inappropriate tool usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

full_governance_reportA

Generate a COMPLETE multi-framework governance report in one call.

Runs EU AI Act risk classification, NIST risk profile, ISO 42001 audit, GDPR assessment, and crosswalk analysis — all at once. The enterprise single-call solution.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: system_name (str): The system name to analyze or process. system_description (str): The system description to analyze or process. jurisdictions (str): The jurisdictions to analyze or process. us: The us to analyze or process. uk": The uk" to analyze or process. use_case (str): The use case to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
system_nameYes
system_descriptionYes
jurisdictionsNoeu,us,uk
use_caseNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It includes a dedicated 'Behavioral Transparency' section detailing side effects (read-only, no modifications), authentication (none for basic, API key for pro), rate limits (10/day free, unlimited pro), error handling (structured errors), idempotency, and data privacy. This is comprehensive and adds significant value beyond typical disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, behavioral, when to use/not, args, behavioral transparency). It is front-loaded with the main purpose. Some redundancy exists (e.g., read-only stated twice), but overall it is concise and organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multi-framework report) and 5 parameters, the description covers authentication, rate limits, error handling, and idempotency. It does not detail the output structure, but an output schema exists. Parameter descriptions are weak, which slightly reduces completeness. Still, sufficient for an agent to judge usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It includes an 'Args' section with one-line descriptions for each parameter. However, some descriptions are identical (e.g., system_name and system_description), and there are typos (e.g., 'us' and 'uk' entries have extra quotes). The api_key description is misleading. While it adds some meaning, the quality is uneven, warranting a 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a comprehensive multi-framework governance report covering EU AI Act, NIST, ISO 42001, GDPR, and crosswalk analysis. It uses a specific verb (generate) and resource (report), and is well-differentiated from sibling tools like compliance_score_engine or which_frameworks_apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'When to use' and 'When NOT to use' sections, covering gap analysis, readiness checks, and compliance documentation. It clearly states not to use as substitute for legal counsel. However, it does not explicitly mention sibling tools as alternatives, which would further aid selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_full_audit_trailA

Get timestamped audit trail of all governance checks performed.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: limit (int): The limit to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, stateless, idempotent, rate limits (free and pro), authentication requirements, error handling, data privacy, and safe retryability. This is comprehensive and prevents misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections and front-loaded purpose. However, the 'Behavioral Transparency' section repeats some content from 'Behavior,' making it slightly redundant. Overall efficient but not maximally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description does not need to detail return structure. It covers rate limits, authentication, and error handling. However, it omits a high-level summary of typical audit trail contents (e.g., check names, timestamps), which could aid quick understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The 'Args' section adds no meaningful detail beyond the schema, using vague phrases like 'The limit to analyze or process.' With schema description coverage at 0%, the description should compensate, but it does not clarify data types, constraints, or typical values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get timestamped audit trail of all governance checks performed.' This is a specific verb+resource combination. While it distinguishes itself from sibling tools like compliance_score_engine by focusing on raw audit data, it does not explicitly contrast with alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes dedicated 'When to use' and 'When NOT to use' sections, guiding agents toward compliance auditing and away from legal advice substitution. It provides clear context but does not compare this tool to specific siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_toolsA

List all 62 governance tools available in this engine.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description fully covers behavioral traits: read-only, stateless, idempotent, no side effects, authentication requirements, rate limits, error handling, and data privacy. Every relevant aspect is disclosed, compensating for the lack of annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections, but some redundancy exists (e.g., 'Behavior' and 'Behavioral Transparency' overlap). It is front-loaded with the core purpose, but could be slightly more concise without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input schema and presence of an output schema, the description covers all necessary context: what the tool does, when to use it, behavioral properties, and error handling. No essential information is missing for an agent to understand and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 1 parameter (api_key) with 0% description coverage in the schema itself. The description adds a one-line 'Args' entry but only restates the parameter name and type without enhancing understanding. More detail on expected format or usage context would improve this dimension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List all 62 governance tools available in this engine,' specifying the verb (list), the resource (governance tools), and the scope (all 62). It distinguishes itself from sibling tools by focusing on enumeration rather than analysis or reporting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance: use for compliance assessment, gap analysis, and documentation; do not use as a substitute for legal advice. This helps the agent decide when to invoke this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

which_frameworks_applyA

Instantly determine which AI governance frameworks apply to your situation.

Input your country, industry, and AI use case. Get back every applicable framework with enforcement status and deadlines.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: country (str): The country to analyze or process. industry (str): The industry to analyze or process. ai_use_case (str): The ai use case to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

ParametersJSON Schema
NameRequiredDescriptionDefault
countryYes
industryNo
ai_use_caseNo
api_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, stateless, idempotent, rate limits (10/day free, unlimited pro), authentication (none for basic, API key for pro), error handling (structured errors), and data privacy (no storage/logging).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized with sections (Behavior, When to use, Args, Behavioral Transparency), but contains redundancy (e.g., 'read-only' repeated twice) and verbose lists. Could be shortened by 30-40% without losing key details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and 4 params (1 required), the description thoroughly covers behavior, limitations, authentication, rate limits, error handling, idempotency, and privacy. Output schema exists, so return values need no explanation. Highly complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% parameter descriptions. The 'Args' section adds brief descriptions for all 4 parameters (country, industry, ai_use_case, api_key), but they are generic (e.g., 'The country to analyze or process') and lack details on valid values or format. Partially compensates but not highly informative.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool determines applicable AI governance frameworks based on country, industry, and use case. It distinguishes itself from sibling tools like compliance_cost_estimator and full_governance_report by focusing on framework identification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' and 'When NOT to use' sections provide clear guidance on appropriate usage for compliance assessment and warn against replacing legal counsel. Also specifies rate limits and authentication requirements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv1.0.0
    • First observedcompliance_cost_estimator
    • First observedcompliance_score_engine
    • First observedfull_governance_report
    • First observedget_full_audit_trail
    • First observedlist_all_tools
    • First observedwhich_frameworks_apply

TDQS

A4.2/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: cost estimation, scoring, comprehensive report, audit trail, tool listing, and framework applicability. No functional overlap.

Naming Consistency4/5

Names follow a predominantly descriptive snake_case pattern. 'which_frameworks_apply' deviates from the verb-noun structure but remains understandable. Overall consistent.

Tool Count4/5

With 6 tools, the set is well-scoped for a governance analysis server. It covers core assessment needs without being bloated.

Completeness4/5

The tool surface covers essential governance assessment tasks: cost, scoring, comprehensive report, audit history, framework selection, and tool discovery. Minor gap in lacking update/action tools, but the set is read-only by design.

Maintenance

ActivityMaintained
ResponsivenessSlow

Related MCP Connectors

Related MCP Servers