get_nis2_certificate

Instructions

Implementation Reference

• server.py:516-578 (registration)

  The @mcp.tool() decorator on line 516 registers `get_nis2_certificate` as an MCP tool.

  @mcp.tool()
  def get_nis2_certificate(entity_name: str, overall_score: float, api_key: str = "") -> str:
      """Generate a timestamped signed NIS2 compliance certificate (Pro/Enterprise tier).
  
      Behavior:
          This tool generates structured output without modifying external systems.
          Output is deterministic for identical inputs. No side effects.
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          entity_name (str): The entity name to analyze or process.
          overall_score (float): The overall score to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg, "upgrade_url": UPGRADE_STRIPE_49})
      if tier == "free":
          return json.dumps({
              "error": "Signed certificates require Pro (£49/mo) or Enterprise (£499/mo) tier.",
              "upgrade_url": UPGRADE_STRIPE_49,
              "what_pro_unlocks": "Signed certificates, unlimited audits, governance-accountability pack, Article 20 training log generator, cross-MCP framework crosswalk.",
          })
      ts = datetime.now(timezone.utc)
      payload = f"{entity_name}|{ts.isoformat()}|{overall_score}|NIS2|MEOK_AI_LABS"
      h = hashlib.sha256(payload.encode()).hexdigest()
      return json.dumps({
          "certificate_id": f"MEOK-NIS2-{h[:12].upper()}",
          "entity": entity_name,
          "issued_utc": ts.isoformat(),
          "valid_until_utc": (ts + timedelta(days=365)).isoformat(),
          "directive": "Directive (EU) 2022/2555 (NIS2)",
          "overall_score_percent": overall_score,
          "assessment": "COMPLIANT" if overall_score >= 70 else "PARTIAL" if overall_score >= 40 else "NON_COMPLIANT",
          "signature_hash_sha256": h,
          "issuer": "MEOK AI Labs",
          "disclaimer": "Automated self-assessment. Does not substitute for competent-authority review.",
      }, indent=2)

• server.py:517-578 (handler)

  The `get_nis2_certificate` function implements the tool logic: takes entity_name, overall_score, and api_key; checks access and tier; generates a SHA-256 signed NIS2 compliance certificate with a certificate ID, timestamps, and validity period.

  def get_nis2_certificate(entity_name: str, overall_score: float, api_key: str = "") -> str:
      """Generate a timestamped signed NIS2 compliance certificate (Pro/Enterprise tier).
  
      Behavior:
          This tool generates structured output without modifying external systems.
          Output is deterministic for identical inputs. No side effects.
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          entity_name (str): The entity name to analyze or process.
          overall_score (float): The overall score to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg, "upgrade_url": UPGRADE_STRIPE_49})
      if tier == "free":
          return json.dumps({
              "error": "Signed certificates require Pro (£49/mo) or Enterprise (£499/mo) tier.",
              "upgrade_url": UPGRADE_STRIPE_49,
              "what_pro_unlocks": "Signed certificates, unlimited audits, governance-accountability pack, Article 20 training log generator, cross-MCP framework crosswalk.",
          })
      ts = datetime.now(timezone.utc)
      payload = f"{entity_name}|{ts.isoformat()}|{overall_score}|NIS2|MEOK_AI_LABS"
      h = hashlib.sha256(payload.encode()).hexdigest()
      return json.dumps({
          "certificate_id": f"MEOK-NIS2-{h[:12].upper()}",
          "entity": entity_name,
          "issued_utc": ts.isoformat(),
          "valid_until_utc": (ts + timedelta(days=365)).isoformat(),
          "directive": "Directive (EU) 2022/2555 (NIS2)",
          "overall_score_percent": overall_score,
          "assessment": "COMPLIANT" if overall_score >= 70 else "PARTIAL" if overall_score >= 40 else "NON_COMPLIANT",
          "signature_hash_sha256": h,
          "issuer": "MEOK AI Labs",
          "disclaimer": "Automated self-assessment. Does not substitute for competent-authority review.",
      }, indent=2)

• server.py:535-553 (schema)

  The function signature and docstring define the input schema: entity_name (str), overall_score (float), api_key (str). The return is a JSON string with certificate_id, entity, issued_utc, valid_until_utc, directive, overall_score_percent, assessment, signature_hash_sha256, issuer, and disclaimer.

  Args:
      entity_name (str): The entity name to analyze or process.
      overall_score (float): The overall score to analyze or process.
      api_key (str): The api key to analyze or process.
  
  Behavioral Transparency:
      - Side Effects: This tool is read-only and produces no side effects. It does not modify
        any external state, databases, or files. All output is computed in-memory and returned
        directly to the caller.
      - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
        require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
      - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
        included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
      - Error Handling: Returns structured error objects with 'error' key on failure.
        Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
      - Idempotency: Fully idempotent — calling with the same inputs always produces the
        same output. Safe to retry on timeout or transient failure.
      - Data Privacy: No input data is stored, logged, or transmitted to external services.
        All processing happens locally within the MCP server process.

• server.py:558-563 (helper)

  Free-tier rate-limit enforcement for the certificate tool — returns an error JSON directing users to upgrade to Pro/Enterprise for signed certificate generation.

  if tier == "free":
      return json.dumps({
          "error": "Signed certificates require Pro (£49/mo) or Enterprise (£499/mo) tier.",
          "upgrade_url": UPGRADE_STRIPE_49,
          "what_pro_unlocks": "Signed certificates, unlimited audits, governance-accountability pack, Article 20 training log generator, cross-MCP framework crosswalk.",
      })