network_segmentation_check

Instructions

Implementation Reference

• server.py:316-402 (handler)

  The network_segmentation_check tool function. Registered via @mcp.tool() decorator, it checks network segmentation for PCI DSS scope reduction. Evaluates 6 checks (network_segmentation, cde_isolation, segmentation_testing, firewall_zones, wireless_isolation, third_party_isolation), computes a segmentation score, determines PCI scope impact (REDUCED or FULL_NETWORK), and returns JSON with results and recommendations.

  @mcp.tool()
  def network_segmentation_check(
      has_segmentation: bool = False,
      cde_isolated: bool = False,
      segmentation_tested: bool = False,
      firewall_between_zones: bool = False,
      wireless_isolated: bool = False,
      third_party_isolated: bool = False,
      caller: str = "",
      api_key: str = "",
  ) -> str:
      """Check network segmentation for PCI DSS scope reduction.
  
      Behavior:
          This tool is read-only and stateless — it produces analysis output
          without modifying any external systems, databases, or files.
          Safe to call repeatedly with identical inputs (idempotent).
          Free tier: 10/day rate limit. Pro tier: unlimited.
          No authentication required for basic usage.
  
      When to use:
          Use this tool when you need to assess, audit, or verify compliance
          requirements. Ideal for gap analysis, readiness checks, and generating
          compliance documentation.
  
      When NOT to use:
          Do not use as a substitute for qualified legal counsel. This tool
          provides technical compliance guidance, not legal advice.
  
      Args:
          has_segmentation (bool): The has segmentation to analyze or process.
          cde_isolated (bool): The cde isolated to analyze or process.
          segmentation_tested (bool): The segmentation tested to analyze or process.
          firewall_between_zones (bool): The firewall between zones to analyze or process.
          wireless_isolated (bool): The wireless isolated to analyze or process.
          third_party_isolated (bool): The third party isolated to analyze or process.
          api_key (str): The api key to analyze or process.
  
      Behavioral Transparency:
          - Side Effects: This tool is read-only and produces no side effects. It does not modify
            any external state, databases, or files. All output is computed in-memory and returned
            directly to the caller.
          - Authentication: No authentication required for basic usage. Pro/Enterprise tiers
            require a valid MEOK API key passed via the MEOK_API_KEY environment variable.
          - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are
            included in responses (X-RateLimit-Remaining, X-RateLimit-Reset).
          - Error Handling: Returns structured error objects with 'error' key on failure.
            Never raises unhandled exceptions. Invalid inputs return descriptive validation errors.
          - Idempotency: Fully idempotent — calling with the same inputs always produces the
            same output. Safe to retry on timeout or transient failure.
          - Data Privacy: No input data is stored, logged, or transmitted to external services.
            All processing happens locally within the MCP server process.
      """
      if err := _check_auth(api_key):
          return err
      if err := _rl(caller):
          return err
  
      checks = {
          "network_segmentation": {"met": has_segmentation, "requirement": "1.3",
              "description": "Network segmentation implemented to isolate CDE"},
          "cde_isolation": {"met": cde_isolated, "requirement": "1.3.1",
              "description": "Cardholder Data Environment isolated from other networks"},
          "segmentation_testing": {"met": segmentation_tested, "requirement": "11.4.5",
              "description": "Segmentation controls tested at least every 6 months"},
          "firewall_zones": {"met": firewall_between_zones, "requirement": "1.3.2",
              "description": "Firewalls between all security zones"},
          "wireless_isolation": {"met": wireless_isolated, "requirement": "1.3.3",
              "description": "Wireless networks isolated from CDE"},
          "third_party_isolation": {"met": third_party_isolated, "requirement": "1.3.4",
              "description": "Third-party connections isolated"},
      }
  
      passed = sum(1 for c in checks.values() if c["met"])
      total = len(checks)
      scope_impact = "REDUCED" if has_segmentation and cde_isolated else "FULL_NETWORK"
  
      return json.dumps({
          "assessment_date": datetime.now().isoformat(),
          "segmentation_score": round(passed / total * 100, 1),
          "pci_scope": scope_impact,
          "checks_passed": passed,
          "checks_total": total,
          "results": {k: v for k, v in checks.items()},
          "recommendation": "Proper segmentation can significantly reduce PCI DSS assessment scope and cost."
              if scope_impact == "FULL_NETWORK" else "Segmentation is reducing your PCI scope effectively.",
      }, indent=2)

• server.py:316-317 (registration)

  Registration of network_segmentation_check via the @mcp.tool() decorator on line 316, making it available as an MCP tool.

  @mcp.tool()
  def network_segmentation_check(

• server.py:30-33 (helper)

  _check_auth helper used by network_segmentation_check to validate API key authentication.

  def _check_auth(api_key: str = "") -> str | None:
      if _MEOK_API_KEY and api_key != _MEOK_API_KEY:
          return "Invalid API key. Get one at https://meok.ai/api-keys"
      return None

• server.py:41-53 (helper)

  _rl helper used by network_segmentation_check to enforce free-tier rate limiting (10 calls/day).

  def _rl(caller: str = "anonymous", tier: str = "free") -> Optional[str]:
      if tier == "pro":
          return None
      now = datetime.now()
      cutoff = now - timedelta(days=1)
      _usage[caller] = [t for t in _usage[caller] if t > cutoff]
      if len(_usage[caller]) >= FREE_DAILY_LIMIT:
          return (
              f"Free tier limit ({FREE_DAILY_LIMIT}/day). "
              "Upgrade: https://meok.ai/mcp/pci-dss/pro"
          )
      _usage[caller].append(now)
      return None