audit_article_21

Instructions

Implementation Reference

• server.py:274-351 (handler)

  The main handler function for the 'audit_article_21' tool. It takes entity_description, current_controls, and api_key, then scores the entity against NIS2 Article 21's 10 risk-management measures using keyword matching. Returns a JSON report with score, pass/fail per measure, gaps, remediation priority, and management body liability note.

  def audit_article_21(entity_description: str, current_controls: str = "", api_key: str = "") -> str:
      """Audit your current controls against NIS2 Article 21's 10 mandatory risk-management measures.
      Returns per-measure evidence status + gap list + sanction exposure tier.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          entity_description (str): The entity description to analyze or process.
          current_controls (str): The current controls to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg, "upgrade_url": UPGRADE_STRIPE_49})
      if err := _check_rate_limit(tier=tier):
          return json.dumps({"error": err, "upgrade_url": UPGRADE_STRIPE_49})
  
      combined = (entity_description + " " + current_controls).lower()
      results = []
      passed = 0
      for n, m in ARTICLE_21_MEASURES.items():
          matched_kws = [kw for kw in m["keywords"] if kw in combined]
          ok = len(matched_kws) > 0
          if ok:
              passed += 1
          results.append({
              "measure": n,
              "name": m["name"],
              "status": "EVIDENCE_FOUND" if ok else "GAP",
              "evidence_signals": matched_kws,
          })
      total = len(ARTICLE_21_MEASURES)
      score = round(passed / total * 100, 1)
      gaps = [r["name"] for r in results if r["status"] == "GAP"]
      return json.dumps({
          "directive": "NIS2 Article 21",
          "score_percent": score,
          "passed": f"{passed}/{total}",
          "assessment": "COMPLIANT" if score >= 70 else "PARTIAL" if score >= 40 else "NON_COMPLIANT",
          "gaps_to_address": gaps,
          "remediation_priority": (
              "CRITICAL — close gaps within 30 days; management body personal liability under Article 20" if score < 40 else
              "HIGH — document evidence + close remaining gaps within 60 days" if score < 70 else
              "MEDIUM — formalise policies, add audit trail"
          ),
          "measures_detail": results,
          "management_body_liability_note": "NIS2 Article 20: management bodies are directly responsible for approving measures AND receive training. National authorities can impose personal liability.",
          "upsell": f"Generate signed governance-accountability evidence pack (Article 20) with Pro tier (£49/mo): {UPGRADE_STRIPE_49}" if tier == "free" else None,
      }, indent=2)

• server.py:273-274 (registration)

  The tool is registered with MCP via the @mcp.tool() decorator on line 273, which makes 'audit_article_21' discoverable as an MCP tool.

  @mcp.tool()
  def audit_article_21(entity_description: str, current_controls: str = "", api_key: str = "") -> str:

• server.py:275-313 (schema)

  The docstring defines the input schema (entity_description: str, current_controls: str, api_key: str) and output behavior for the audit_article_21 tool.

  """Audit your current controls against NIS2 Article 21's 10 mandatory risk-management measures.
  Returns per-measure evidence status + gap list + sanction exposure tier.
  
  Behavior:
      This tool is read-only and stateless — it produces analysis output
      without modifying any external systems, databases, or files.
      Safe to call repeatedly with identical inputs (idempotent).
      Free tier: 10/day rate limit. Pro tier: unlimited.
      No authentication required for basic usage.
  
  When to use:
      Use this tool when you need to assess, audit, or verify compliance
      requirements. Ideal for gap analysis, readiness checks, and generating
      compliance documentation.
  
  When NOT to use:
      Do not use as a substitute for qualified legal counsel. This tool
      provides technical compliance guidance, not legal advice.
  
  Args:
      entity_description (str): The entity description to analyze or process.
      current_controls (str): The current controls to analyze or process.
      api_key (str): The api key to analyze or process.
  
  Behavioral Transparency:
      - Side Effects: This tool is read-only and produces no side effects. It does not modify
        any external state, databases, or files. All output is computed in-memory and returned
        directly to the caller.
      - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
        require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
      - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
        included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
      - Error Handling: Returns structured error objects with 'error' key on failure.
        Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
      - Idempotency: Fully idempotent — calling with the same inputs always produces the
        same output. Safe to retry on timeout or transient failure.
      - Data Privacy: No input data is stored, logged, or transmitted to external services.
        All processing happens locally within the MCP server process.
  """

• server.py:104-115 (helper)

  The ARTICLE_21_MEASURES dictionary defining all 10 NIS2 Article 21 risk-management measures and their associated keywords, used by audit_article_21 to match against user-provided controls.

  ARTICLE_21_MEASURES = {
      1: {"name": "Risk analysis and information system security policies", "keywords": ["risk assessment", "security policy", "policies", "iso 27005"]},
      2: {"name": "Incident handling", "keywords": ["incident response", "ir playbook", "cert", "csirt"]},
      3: {"name": "Business continuity (backups, disaster recovery, crisis management)", "keywords": ["bcp", "dr", "backup", "disaster recovery", "business continuity", "crisis management"]},
      4: {"name": "Supply chain security (direct suppliers + service providers)", "keywords": ["supply chain", "vendor assessment", "tprm", "third party risk", "sbom"]},
      5: {"name": "Security in network and information systems acquisition, development, and maintenance, including vulnerability handling", "keywords": ["secure sdlc", "vulnerability management", "patching", "cve", "sast", "dast"]},
      6: {"name": "Policies and procedures to assess effectiveness of cybersecurity risk-management measures", "keywords": ["audit", "kpi", "metrics", "effectiveness", "maturity model"]},
      7: {"name": "Basic cyber hygiene practices and cybersecurity training", "keywords": ["training", "awareness", "cyber hygiene", "phishing simulation"]},
      8: {"name": "Policies and procedures regarding the use of cryptography and encryption", "keywords": ["encryption", "cryptography", "tls", "aes", "pki", "kms"]},
      9: {"name": "Human resources security, access control policies, and asset management", "keywords": ["iam", "access control", "rbac", "mfa", "sso", "privileged access", "asset inventory"]},
      10: {"name": "Multi-factor or continuous authentication, secured communication (voice/video/text), and secured emergency comms", "keywords": ["mfa", "2fa", "zero trust", "signal", "secure comms", "continuous authentication"]},
  }