list_article_21_measures

Instructions

Implementation Reference

• server.py:225-270 (handler)

  The main handler function for the list_article_21_measures tool. It checks access, then returns the 10 NIS2 Article 21 risk-management measures from the ARTICLE_21_MEASURES dictionary as a JSON string.

  @mcp.tool()
  def list_article_21_measures(api_key: str = "") -> str:
      """List all 10 cybersecurity risk-management measures required under NIS2 Article 21.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg, "upgrade_url": UPGRADE_STRIPE_49})
      return json.dumps({
          "directive": "Directive (EU) 2022/2555 (NIS2)",
          "article": "Article 21 — Cybersecurity risk-management measures (minimum baseline)",
          "measures": [{"number": n, **m} for n, m in ARTICLE_21_MEASURES.items()],
      }, indent=2)

• server.py:104-115 (schema)

  The data schema defining all 10 Article 21 measures. Each entry has a number, name, and keywords list used by the handler to produce the output.

  ARTICLE_21_MEASURES = {
      1: {"name": "Risk analysis and information system security policies", "keywords": ["risk assessment", "security policy", "policies", "iso 27005"]},
      2: {"name": "Incident handling", "keywords": ["incident response", "ir playbook", "cert", "csirt"]},
      3: {"name": "Business continuity (backups, disaster recovery, crisis management)", "keywords": ["bcp", "dr", "backup", "disaster recovery", "business continuity", "crisis management"]},
      4: {"name": "Supply chain security (direct suppliers + service providers)", "keywords": ["supply chain", "vendor assessment", "tprm", "third party risk", "sbom"]},
      5: {"name": "Security in network and information systems acquisition, development, and maintenance, including vulnerability handling", "keywords": ["secure sdlc", "vulnerability management", "patching", "cve", "sast", "dast"]},
      6: {"name": "Policies and procedures to assess effectiveness of cybersecurity risk-management measures", "keywords": ["audit", "kpi", "metrics", "effectiveness", "maturity model"]},
      7: {"name": "Basic cyber hygiene practices and cybersecurity training", "keywords": ["training", "awareness", "cyber hygiene", "phishing simulation"]},
      8: {"name": "Policies and procedures regarding the use of cryptography and encryption", "keywords": ["encryption", "cryptography", "tls", "aes", "pki", "kms"]},
      9: {"name": "Human resources security, access control policies, and asset management", "keywords": ["iam", "access control", "rbac", "mfa", "sso", "privileged access", "asset inventory"]},
      10: {"name": "Multi-factor or continuous authentication, secured communication (voice/video/text), and secured emergency comms", "keywords": ["mfa", "2fa", "zero trust", "signal", "secure comms", "continuous authentication"]},
  }

• server.py:225-226 (registration)

  The tool is registered via the @mcp.tool() decorator on the FastMCP instance 'mcp' (created at line 119), making it discoverable as an MCP tool named 'list_article_21_measures'.

  @mcp.tool()
  def list_article_21_measures(api_key: str = "") -> str: