PCI DSS MCP

Overview Schema Source Related Servers Discussions Admin

network_segmentation_check

Evaluate network segmentation to reduce PCI DSS scope. Assess isolation of CDE, wireless, and third-party zones with firewall and testing checks.

Instructions

Check network segmentation for PCI DSS scope reduction.

Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.

When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.

When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.

Args: has_segmentation (bool): The has segmentation to analyze or process. cde_isolated (bool): The cde isolated to analyze or process. segmentation_tested (bool): The segmentation tested to analyze or process. firewall_between_zones (bool): The firewall between zones to analyze or process. wireless_isolated (bool): The wireless isolated to analyze or process. third_party_isolated (bool): The third party isolated to analyze or process. api_key (str): The api key to analyze or process.

Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "network_segmentation_check"
  }
}

Input Schema

Name	Required	Description	Default
`has_segmentation`	No
`cde_isolated`	No
`segmentation_tested`	No
`firewall_between_zones`	No
`wireless_isolated`	No
`third_party_isolated`	No
`caller`	No
`api_key`	No

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.0.4May 8, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description thoroughly covers side effects (read-only, stateless), authentication, rate limits, error handling, idempotency, and data privacy. This is exemplary beyond typical descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections and front-loaded purpose. However, the 'Behavior' and 'Behavioral Transparency' sections overlap slightly, and the 'Args' section is verbose without adding value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers many aspects: purpose, behavior, usage guidelines, error handling. Missing high-level output description (though output schema exists). Parameter explanations are weak. Overall adequate but not fully comprehensive given tool complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. However, the 'Args' section provides only generic restatements of parameter names (e.g., 'The has segmentation to analyze or process'), adding negligible semantic value. No explanation of how parameters affect output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb+resource: 'Check network segmentation for PCI DSS scope reduction.' It is distinct from siblings like assess_pci_compliance (broader) and vulnerability_scan_check (different focus).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Includes 'When to use' and 'When NOT to use' sections, but they are generic and do not explicitly differentiate from sibling tools. Provides context for compliance use but lacks comparative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server