management_body_checklist

Instructions

Implementation Reference

• server.py:456-513 (handler)

  The `management_body_checklist` tool handler. It is decorated with @mcp.tool(), checks access via check_access(), and returns a JSON object with NIS2 Article 20 governance/accountability checklist including directive info, personal liability, required training, a detailed checklist, and failure consequences.

  @mcp.tool()
  def management_body_checklist(api_key: str = "") -> str:
      """NIS2 Article 20 — management body accountability checklist. Directors can be held personally liable.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return json.dumps({"error": msg})
      return json.dumps({
          "directive": "NIS2 Article 20 — Governance",
          "accountability": "Management bodies of essential and important entities must: (a) approve the cybersecurity risk-management measures taken, (b) oversee their implementation, (c) be held liable for infringements.",
          "personal_liability": "National law may impose personal liability on managers. Several Member States (e.g., Germany) have already transposed this broadly.",
          "required_training": "Members of management bodies MUST undergo regular cybersecurity training sufficient to: identify risks, assess risk-management practices, understand impact on services.",
          "checklist": [
              "Documented approval of cybersecurity risk-management policies (dated, signed by management body)",
              "Quarterly management-body review of cybersecurity posture (documented minutes)",
              "Annual cybersecurity training completion records for all management-body members",
              "Documented training curriculum covering NIS2 Article 21 measures",
              "Incident-response role for management body defined (Article 23 escalation)",
              "Independent assurance (internal audit or external) of Article 21 measures",
              "Register of management-body decisions on risk acceptance",
              "Escalation path for significant incidents to management body documented",
          ],
          "failure_consequences": "Non-compliance with Article 20 can lead to: temporary suspension of certification/authorisation, temporary prohibition from management functions, public disclosure of infringement.",
      }, indent=2)

• server.py:456-456 (registration)

  The tool is registered as an MCP tool via the @mcp.tool() decorator on line 456 of server.py. No explicit schema is defined beyond the function signature and docstring.

  @mcp.tool()

• server.py:37-50 (helper)

  The check_access helper function used within management_body_checklist to gate access based on API key. It imports from auth_middleware or uses a fallback.

      from auth_middleware import check_access as _shared_check_access
      _AUTH_ENGINE_AVAILABLE = True
  except ImportError:
      _AUTH_ENGINE_AVAILABLE = False
      def _shared_check_access(api_key: str = ""):
          if _MEOK_API_KEY and api_key and api_key == _MEOK_API_KEY:
              return True, "OK", "pro"
          if _MEOK_API_KEY and api_key and api_key != _MEOK_API_KEY:
              return False, "Invalid API key. Get one at https://meok.ai/api-keys", "free"
          return True, "OK", "free"
  
  
  def check_access(api_key: str = ""):
      return _shared_check_access(api_key)