assess_pci_compliance

Instructions

Implementation Reference

• server.py:111-215 (handler)

  The actual tool handler function 'assess_pci_compliance'. It evaluates an organization against all 12 PCI DSS 4.0 requirements, taking boolean flags for each requirement and returning a JSON compliance assessment with pass/fail per requirement and an overall score.

  def assess_pci_compliance(
      organization_name: str,
      merchant_level: int = 4,
      has_firewall: bool = False,
      has_secure_config: bool = False,
      has_data_protection: bool = False,
      has_encryption_transit: bool = False,
      has_anti_malware: bool = False,
      has_secure_sdlc: bool = False,
      has_access_control: bool = False,
      has_strong_auth: bool = False,
      has_physical_security: bool = False,
      has_logging: bool = False,
      has_security_testing: bool = False,
      has_security_policy: bool = False,
      caller: str = "",
      api_key: str = "",
  ) -> str:
      """Evaluate an organization against all 12 PCI DSS 4.0 requirements.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          organization_name (str): The organization name to analyze or process.
          merchant_level (int): The merchant level to analyze or process.
          has_firewall (bool): The has firewall to analyze or process.
          has_secure_config (bool): The has secure config to analyze or process.
          has_data_protection (bool): The has data protection to analyze or process.
          has_encryption_transit (bool): The has encryption transit to analyze or process.
          has_anti_malware (bool): The has anti malware to analyze or process.
          has_secure_sdlc (bool): The has secure sdlc to analyze or process.
          has_access_control (bool): The has access control to analyze or process.
          has_strong_auth (bool): The has strong auth to analyze or process.
          has_physical_security (bool): The has physical security to analyze or process.
          has_logging (bool): The has logging to analyze or process.
          has_security_testing (bool): The has security testing to analyze or process.
          has_security_policy (bool): The has security policy to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      if err := _check_auth(api_key):
          return err
      if err := _rl(caller):
          return err
  
      req_status = {
          "1": has_firewall, "2": has_secure_config, "3": has_data_protection,
          "4": has_encryption_transit, "5": has_anti_malware, "6": has_secure_sdlc,
          "7": has_access_control, "8": has_strong_auth, "9": has_physical_security,
          "10": has_logging, "11": has_security_testing, "12": has_security_policy,
      }
  
      results = []
      for req_id, met in req_status.items():
          req = PCI_REQUIREMENTS[req_id]
          results.append({
              "requirement": req_id,
              "name": req["name"],
              "category": req["category"],
              "status": "PASS" if met else "FAIL",
              "checks_needed": req["checks"],
          })
  
      passed = sum(1 for r in results if r["status"] == "PASS")
      score = round(passed / 12 * 100, 1)
  
      return json.dumps({
          "organization": organization_name,
          "merchant_level": merchant_level,
          "pci_dss_version": "4.0",
          "assessment_date": datetime.now().isoformat(),
          "overall_score": score,
          "compliance_status": "COMPLIANT" if passed == 12 else "NON_COMPLIANT",
          "requirements_passed": passed,
          "requirements_failed": 12 - passed,
          "results": results,
      }, indent=2)

• server.py:58-83 (schema)

  The PCI_REQUIREMENTS data dictionary that defines the 12 PCI DSS 4.0 requirements, their names, categories, and check items used by the tool to produce results.

  PCI_REQUIREMENTS = {
      "1": {"name": "Install and Maintain Network Security Controls", "category": "Build and Maintain a Secure Network",
            "checks": ["firewall_config", "network_diagram", "dmz_implemented", "personal_firewall"]},
      "2": {"name": "Apply Secure Configurations to All System Components", "category": "Build and Maintain a Secure Network",
            "checks": ["no_vendor_defaults", "system_hardening", "non_console_encryption", "primary_functions_only"]},
      "3": {"name": "Protect Stored Account Data", "category": "Protect Account Data",
            "checks": ["data_retention_policy", "no_sensitive_auth_data", "pan_masked", "encryption_key_management"]},
      "4": {"name": "Protect Cardholder Data with Strong Cryptography During Transmission", "category": "Protect Account Data",
            "checks": ["strong_cryptography", "no_pan_via_messaging", "tls_1_2_minimum"]},
      "5": {"name": "Protect All Systems and Networks from Malicious Software", "category": "Maintain a Vulnerability Management Program",
            "checks": ["anti_malware_deployed", "anti_malware_current", "periodic_scans", "anti_malware_logging"]},
      "6": {"name": "Develop and Maintain Secure Systems and Software", "category": "Maintain a Vulnerability Management Program",
            "checks": ["security_patches", "sdlc_process", "change_control", "web_app_protection"]},
      "7": {"name": "Restrict Access to System Components and Cardholder Data by Business Need to Know", "category": "Implement Strong Access Control",
            "checks": ["access_control_system", "least_privilege", "default_deny"]},
      "8": {"name": "Identify Users and Authenticate Access to System Components", "category": "Implement Strong Access Control",
            "checks": ["unique_ids", "strong_authentication", "mfa_for_admin", "password_policy"]},
      "9": {"name": "Restrict Physical Access to Cardholder Data", "category": "Implement Strong Access Control",
            "checks": ["physical_access_controls", "visitor_management", "media_controls"]},
      "10": {"name": "Log and Monitor All Access to System Components and Cardholder Data", "category": "Regularly Monitor and Test Networks",
             "checks": ["audit_trails", "time_synchronization", "log_review", "log_retention"]},
      "11": {"name": "Test Security of Systems and Networks Regularly", "category": "Regularly Monitor and Test Networks",
             "checks": ["wireless_scanning", "vulnerability_scans", "penetration_testing", "ids_ips"]},
      "12": {"name": "Support Information Security with Organizational Policies and Programs", "category": "Maintain an Information Security Policy",
             "checks": ["security_policy", "risk_assessment", "security_awareness", "incident_response"]},
  }

• server.py:107-110 (registration)

  The 'assess_pci_compliance' function is registered as an MCP tool via the '@mcp.tool()' decorator on line 110.

  )
  
  
  @mcp.tool()

• server.py:30-33 (helper)

  Helper function '_check_auth' for API key validation used in the tool.

  def _check_auth(api_key: str = "") -> str | None:
      if _MEOK_API_KEY and api_key != _MEOK_API_KEY:
          return "Invalid API key. Get one at https://meok.ai/api-keys"
      return None

• server.py:41-53 (helper)

  Helper function '_rl' for rate limiting (free tier: 10 calls/day) used by the tool.

  def _rl(caller: str = "anonymous", tier: str = "free") -> Optional[str]:
      if tier == "pro":
          return None
      now = datetime.now()
      cutoff = now - timedelta(days=1)
      _usage[caller] = [t for t in _usage[caller] if t > cutoff]
      if len(_usage[caller]) >= FREE_DAILY_LIMIT:
          return (
              f"Free tier limit ({FREE_DAILY_LIMIT}/day). "
              "Upgrade: https://meok.ai/mcp/pci-dss/pro"
          )
      _usage[caller].append(now)
      return None