Skip to main content
Glama
Sign In
deenesjakoruzh
PCI DSS MCP

PCI DSS MCP

by CSOAI-ORG
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

MCP Scorecard: 90/100

Pci Dss MCP

MEOK AI Labs GSPC License PyPI

PCI DSS 4

PCI DSS 4.0 payment card compliance MCP server ā€” 12 requirements assessment, cardholder data flow, network segmentation, SAQ generation

šŸš€ Quick Start

# Install via pip
pip install pci_dss_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install pci-dss-mcp --client claude

Related MCP server: ISO 27001 AI MCP

āœØ Features

  • MCP protocol compliant

  • Easy installation

  • Well-documented API

  • Production-ready

  • Active maintenance

šŸ“– Documentation

šŸ›”ļø Compliance

This MCP server is built with EU AI Act compliance built-in:

  • āœ… Article 9 ā€” Risk Management System

  • āœ… Article 13 ā€” Transparency & Instructions for Use

  • āœ… Article 15 ā€” Bias Detection & Testing

  • āœ… Article 26 ā€” FRIA Support (where applicable)

  • āœ… Article 50 ā€” AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic ā†’

šŸ¢ Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo ā€” Full MCP suite + EU AI Act tracking

  • Enterprise: $499/mo ā€” Custom dev + SLA + Dedicated support

View Pricing ā†’ | Contact Sales ā†’

šŸ¤ Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem ā€” 300+ MCP servers for sovereign AI governance.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

meok.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

šŸ“œ License

MIT Ā© CSOAI-ORG

Pairs with MEOK Governance Suite

Build something that touches users? You need compliance. MEOK ships 38 governance MCPs that drop in alongside this tool ā€” EU AI Act, DORA, NIS2, CRA, GDPR, ISO 42001, FDA SaMD, MDR, Basel, MiFID II, MiCA, COPPA, and more.

# One-shot install of the governance pack
npx meok-setup --pack governance

Free tier: 10 calls/day per MCP. Pro tier (Ā£79/mo): unlimited + cryptographically signed compliance attestations your auditor verifies independently.

ā†’ Full catalogue: councilof.ai/catalogue ā†’ MEOK AI Labs: meok.ai

šŸ’ø Try MEOK in 30 seconds ā€” instant buy ladder

Tier

Price

What you get

Stripe

Smoke test

Ā£1

Signed sample MCP-Hardening report + Article 50 PDF

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Quick Kit

Ā£9

EU AI Act Article 50 implementation guide (C2PA + EU-Icon)

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Founder Call

Ā£29

30-min 1-on-1 with the founder

https://buy.stripe.com/aFa7sNcgAdQS0ZT1Uc8k91t

Refundable. UK Stripe ā€” VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Configuration

Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:

{
  "mcpServers": {
    "pci-dss-mcp": {
      "command": "uvx",
      "args": ["pci-dss-mcp"]
    }
  }
}

Or: pip install pci-dss-mcp then run the pci-dss-mcp command (stdio transport).

Examples

Once configured, ask your assistant, for example:

  • "Use assess_pci_compliance to ā€¦"

  • "Use check_cardholder_data to ā€¦"

  • "Use network_segmentation_check to ā€¦"

Available Tools

5 tools
assess_pci_complianceA

Evaluate an organization against all 12 PCI DSS 4.0 requirements.

Behavior: This tool is read-only and stateless ā€” it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: organization_name (str): The organization name to analyze or process. merchant_level (int): The merchant level to analyze or process. has_firewall (bool): The has firewall to analyze or process. has_secure_config (bool): The has secure config to analyze or process. has_data_protection (bool): The has data protection to analyze or process. has_encryption_transit (bool): The has encryption transit to analyze or process. has_anti_malware (bool): The has anti malware to analyze or process. has_secure_sdlc (bool): The has secure sdlc to analyze or process. has_access_control (bool): The has access control to analyze or process. has_strong_auth (bool): The has strong auth to analyze or process. has_physical_security (bool): The has physical security to analyze or process. has_logging (bool): The has logging to analyze or process. has_security_testing (bool): The has security testing to analyze or process. has_security_policy (bool): The has security policy to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā€” calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Inputs: organization_name (required), merchant_level, has_firewall, has_secure_config, +12 more. Returns: result

check_cardholder_dataA

Analyze cardholder data flow for PCI DSS compliance.

Behavior: This tool is read-only and stateless ā€” it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: data_flow_description (str): The data flow description to analyze or process. stores_pan (bool): The stores pan to analyze or process. stores_cvv (bool): The stores cvv to analyze or process. stores_pin (bool): The stores pin to analyze or process. stores_track_data (bool): The stores track data to analyze or process. pan_encrypted (bool): The pan encrypted to analyze or process. pan_truncated (bool): The pan truncated to analyze or process. tokenization_used (bool): The tokenization used to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā€” calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Inputs: data_flow_description (required), stores_pan, stores_cvv, stores_pin, +6 more. Returns: result

generate_saqA

Generate a PCI DSS Self-Assessment Questionnaire template.

Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: organization_name (str): The organization name to analyze or process. saq_type (str): The saq type to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā€” calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Inputs: organization_name (required), saq_type, caller, api_key. Returns: result

network_segmentation_checkA

Check network segmentation for PCI DSS scope reduction.

Behavior: This tool is read-only and stateless ā€” it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: has_segmentation (bool): The has segmentation to analyze or process. cde_isolated (bool): The cde isolated to analyze or process. segmentation_tested (bool): The segmentation tested to analyze or process. firewall_between_zones (bool): The firewall between zones to analyze or process. wireless_isolated (bool): The wireless isolated to analyze or process. third_party_isolated (bool): The third party isolated to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā€” calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Inputs: has_segmentation, cde_isolated, segmentation_tested, firewall_between_zones, +4 more. Returns: result

vulnerability_scan_checkA

Evaluate vulnerability scanning compliance per PCI DSS ASV requirements.

Behavior: This tool is read-only and stateless ā€” it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: last_external_scan_date (str): The last external scan date to analyze or process. last_internal_scan_date (str): The last internal scan date to analyze or process. external_scan_passed (bool): The external scan passed to analyze or process. internal_scan_passed (bool): The internal scan passed to analyze or process. asv_vendor (str): The asv vendor to analyze or process. quarterly_scans (bool): The quarterly scans to analyze or process. scan_after_changes (bool): The scan after changes to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent ā€” calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Inputs: last_external_scan_date, last_internal_scan_date, external_scan_passed, internal_scan_passed, +5 more. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelogā€¦

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.3/5.0

    Scored across 5 tools

    Disambiguation5/5

    Each tool targets a distinct PCI DSS domain (overall compliance, cardholder data flow, SAQ generation, network segmentation, vulnerability scanning). There is no overlap; an agent can clearly differentiate them.

    Naming Consistency5/5

    All tool names follow a consistent verb_noun pattern in snake_case (e.g., assess_pci_compliance, generate_saq). The naming convention is uniform and predictable.

    Tool Count5/5

    With 5 tools, the server is well-scoped for PCI DSS compliance. Each tool serves a core function without being too sparse or bloated.

    Completeness4/5

    The set covers major PCI DSS areas: overall assessment, data flow, SAQ, network segmentation, and vulnerability scanning. Minor gaps exist (e.g., no tool for detailed requirement checks or remediation tracking), but the core workflow is covered.

    Maintenance

    ActivityStale
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers