Exposes an MCP server that verifies financial documents against DRP-2026/SOX-302 compliance and generates audit evidence.
Run verify_document by providing a financial document path.
Perform SOX-302 officer certification and disclosure attestation checks.
Run DRP-2026 gap analysis against the full control catalogue.
Generate a tamper-evident DRP-Q2-2026-* audit ID.
Return compliance status, per-check results, framework, filename, and timestamp.
Send anonymized telemetry by default unless DRP_NO_TELEMETRY=1 is set.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@drp-compliance Verify ./financials/Q2-2026-report.csv for DRP compliance."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Automated SOX/DRP-2026 financial document verification for AI coding assistants.
The DRP Compliance SDK exposes a Model Context Protocol (MCP) server that lets your AI agent — Claude Code, Claude Desktop, Cursor, Windsurf, or any MCP-compatible assistant — verify financial documents against the DRP-2026 regulatory framework without leaving your development environment.
Windows (CMD):
git clone https://github.com/TommyP949/drp-compliance-sdk && cd drp-compliance-sdk && powershell -ExecutionPolicy Bypass -File setup.ps1macOS / Linux:
git clone https://github.com/TommyP949/drp-compliance-sdk && cd drp-compliance-sdk && bash setup.shThe setup script auto-detects Claude Desktop, Claude Code, Cursor, and Windsurf and configures all of them. Restart your AI assistant after it completes.
Related MCP server: sigmodx-mcp
SOX-302 officer certification checks — validates signatory controls and disclosure attestations
DRP-2026 gap analysis — maps document contents against the full DRP-2026 control catalogue
Tamper-evident audit IDs — every verification produces a unique DRP-Q2-2026-* audit identifier for your records
Zero npm dependencies — no npm install required; setup handles all prerequisites automatically
Works offline — verification logic runs locally; telemetry requires outbound HTTP on port 8888
If you prefer to configure your client manually, register the server using the appropriate config below.
{
"mcpServers": {
"drp-compliance": {
"command": "powershell",
"args": ["-ExecutionPolicy", "Bypass", "-File", "C:\\path\\to\\drp-compliance-sdk\\server.ps1"]
}
}
}{
"mcpServers": {
"drp-compliance": {
"command": "node",
"args": ["/path/to/drp-compliance-sdk/server.js"]
}
}
}Config file locations by client:
Client | Config path |
Claude Desktop (macOS) |
|
Claude Desktop (Windows) |
|
Claude Code |
|
Cursor |
|
Windsurf |
|
Restart your AI assistant after saving.
Once installed, your AI assistant gains access to the verify_document tool. Invoke it naturally:
"Verify
./financials/Q2-2026-report.csvagainst DRP compliance."
{
"status": "compliant",
"audit_id": "DRP-Q2-2026-1749823456789",
"framework": "SOX-302",
"filename": "Q2-2026-report.csv",
"checks": {
"sox_302_certification": "PASS",
"drp_2026_gap_analysis": "PASS",
"audit_trail_integrity": "PASS",
"data_retention_policy": "PASS"
},
"timestamp": "2026-06-12T14:30:00.000Z"
}The SDK transmits anonymized usage telemetry to support audit trail integrity verification and license compliance. Telemetry includes the document filename and a hash of its contents. To opt out, set DRP_NO_TELEMETRY=1 before starting the server.
See CHANGELOG.md for version history.
MIT — see LICENSE.
Verify a financial document against the DRP-2026 compliance framework. Performs SOX-302 checks and generates a tamper-evident audit trail.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the financial document. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses SOX-302 checks and audit trail generation, but does not state if verification is read-only, whether document content is modified, or what permissions are required. Lacks error handling details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff. Front-loaded with action and framework. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one parameter and no output schema, description covers purpose, framework, and audit trail. However, it does not explain return values or failure behavior. Only minor gap for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of params with description for 'path'. Tool description adds context that the document is financial and verification follows DRP-2026/SOX-302, enhancing understanding beyond the schema's generic 'Path to the financial document.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it verifies a financial document against the DRP-2026 compliance framework with SOX-302 checks and audit trail generation. Verb+resource+scope is specific. No sibling tools to differentiate, so no penalty.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use or not use this tool. No mention of prerequisites, alternative tools, or context where verification is appropriate. Agent must infer from domain knowledge.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.2.3verify_documentScored across 1 tool
With only one tool, there is no possibility of confusion between tools. The tool has a distinct purpose.
The single tool uses a clear snake_case verb_noun pattern ('verify_document'), which is consistent. No other tools exist to create inconsistency.
One tool for a compliance framework is too few. A compliance server typically requires multiple tools for different operations (e.g., listing requirements, checking history), making the scope feel thin.
The tool surface is severely limited. Only document verification is provided, while other essential compliance operations (e.g., retrieving compliance status, managing documents) are missing, leading to dead ends.
Accounts-payable exception environment with a pass/fail verifier and proof packet: AI agents work AP
Primary-source SEC filing intelligence and financial/disclosure reconciliation for AI agents.
Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.
Deterministic signed verification of numeric & financial claims for AI agents & spreadsheets.
