signed_tlpt_attestation

Instructions

Implementation Reference

• meok_dora_tlpt_planner/server.py:301-355 (handler)

  The @mcp.tool() decorated function 'signed_tlpt_attestation' that implements the tool logic. It builds a DORA TLPT attestation payload, sends it to the meok-attestation-api /sign endpoint, and returns the signed attestation with a verification URL. On API failure, it returns a fallback self-attestation payload.

  @mcp.tool()
  def signed_tlpt_attestation(
      entity_name: str,
      scope_summary: str,
      test_phase: str,
      findings_summary: dict[str, Any],
      signing_role: str = "white-team-lead",
  ) -> dict[str, Any]:
      """Produce an HMAC-signed TLPT attestation via the public meok-attestation-api.
  
      Args:
          entity_name: Legal name of the financial entity.
          scope_summary: 1-3 sentence summary of test scope.
          test_phase: One of preparation / testing / closure.
          findings_summary: Dict with findings_count, severity_distribution, and summary text.
          signing_role: Role of the signer (default white-team-lead).
  
      Returns:
          Signed attestation with verification URL.
      """
      payload = {
          "kind": "dora-tlpt-attestation",
          "entity": entity_name,
          "scope": scope_summary,
          "phase": test_phase,
          "findings": findings_summary,
          "signing_role": signing_role,
          "signed_at": datetime.now(timezone.utc).isoformat(),
          "regulatory_basis": "DORA Reg (EU) 2022/2554 Art. 26-27 + TIBER-EU v2.0",
          "tool": "meok-dora-tlpt-planner-mcp",
          "tool_version": "1.0.0",
      }
  
      try:
          req = urllib.request.Request(
              f"{ATTESTATION_API}/sign",
              data=json.dumps({"payload": payload, "type": "dora-tlpt"}).encode("utf-8"),
              headers={"Content-Type": "application/json"},
          )
          with urllib.request.urlopen(req, timeout=10) as resp:
              result = json.loads(resp.read().decode("utf-8"))
          return {
              "ok": True,
              "payload": payload,
              "signature": result.get("signature"),
              "verify_url": result.get("verify_url"),
              "attestation_id": result.get("attestation_id"),
          }
      except urllib.error.URLError as e:
          return {
              "ok": False,
              "error": f"attestation API unreachable: {e}",
              "payload": payload,
              "fallback": "Use the payload above as a self-attestation; sign locally with your own HMAC key.",
          }

• meok_dora_tlpt_planner/server.py:301-301 (registration)

  The @mcp.tool() decorator registers 'signed_tlpt_attestation' as an MCP tool with the FastMCP server instance.

  @mcp.tool()

• meok_dora_tlpt_planner/server.py:26-26 (helper)

  The ATTESTATION_API constant used by the handler to send the signing request to the meok-attestation-api.

  ATTESTATION_API = os.environ.get("MEOK_ATTESTATION_API", "https://meok-attestation-api.vercel.app")