assess_pci_compliance
Assess an organization against all 12 PCI DSS 4.0 requirements to identify compliance gaps and generate documentation.
Instructions
Evaluate an organization against all 12 PCI DSS 4.0 requirements.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Args: organization_name (str): The organization name to analyze or process. merchant_level (int): The merchant level to analyze or process. has_firewall (bool): The has firewall to analyze or process. has_secure_config (bool): The has secure config to analyze or process. has_data_protection (bool): The has data protection to analyze or process. has_encryption_transit (bool): The has encryption transit to analyze or process. has_anti_malware (bool): The has anti malware to analyze or process. has_secure_sdlc (bool): The has secure sdlc to analyze or process. has_access_control (bool): The has access control to analyze or process. has_strong_auth (bool): The has strong auth to analyze or process. has_physical_security (bool): The has physical security to analyze or process. has_logging (bool): The has logging to analyze or process. has_security_testing (bool): The has security testing to analyze or process. has_security_policy (bool): The has security policy to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| organization_name | Yes | ||
| merchant_level | No | ||
| has_firewall | No | ||
| has_secure_config | No | ||
| has_data_protection | No | ||
| has_encryption_transit | No | ||
| has_anti_malware | No | ||
| has_secure_sdlc | No | ||
| has_access_control | No | ||
| has_strong_auth | No | ||
| has_physical_security | No | ||
| has_logging | No | ||
| has_security_testing | No | ||
| has_security_policy | No | ||
| caller | No | ||
| api_key | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |