receipts-compliance-mcp-mit
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| verify_manifestA | Verify a signed receipt bundle manifest (MANIFEST.signed.json) against an Ed25519 public key. Recomputes the manifest hash and checks the signature. Use before building a report from a receipt set you did not produce yourself. Does not check the ML-DSA-65 half of a v3 signature. |
| build_annex_ivA | Build an EU AI Act Annex IV technical-documentation report from a set of VAOS receipts. Article 11 of Regulation (EU) 2024/1689 requires this for every high-risk AI system. Returns Markdown ready to file with the EU AI Office. |
| build_iso_42001A | Build an ISO/IEC 42001:2023 AI management system (AIMS) report from a set of VAOS receipts. Covers clauses 4-10 + the 38-control Annex A matrix. Returns Markdown ready to hand to your certification body (BSI, TÜV SÜD, etc.). |
| build_nist_ai_rmfA | Build a NIST AI RMF 1.0 profile (GOVERN / MAP / MEASURE / MANAGE) from a set of VAOS receipts. The de-facto US federal AI risk-management standard. Returns Markdown with per-subcategory evidence counts and trustworthy-AI characteristic coverage. |
| build_soc2_evidenceA | Build a SOC 2 evidence binder mapped to AICPA Trust Service Criteria (2017) — security (CC1-CC9), availability (A1), processing integrity (PI1), confidentiality (C1), privacy (P-series). Each criterion gets a receipt-derived evidence count + days-of-coverage metric. Returns Markdown to walk into the audit kickoff with. |
| build_gdpr_dpiaA | Build a GDPR Article 35 DPIA + Article 30 RoPA report from operator-declared processing activities + a VAOS receipt set. Returns Markdown ready for the DPO + supervisory authority. High-residual-risk activities automatically flagged for Article 36 prior consultation. |
| build_hipaa_securityA | Build a HIPAA Security Rule (45 CFR § 164.308-318) evidence binder from a set of VAOS receipts. Maps every implementation specification to receipt-derived evidence. REQUIRED specifications without evidence are surfaced as findings; ADDRESSABLE specifications can be marked alternative-implemented with an operator note. |
| build_iso_23894A | Build an ISO/IEC 23894:2023 AI risk-management report from operator-declared risk scenarios + a VAOS receipt set. Computes inherent + residual risk per scenario via the 5×5 likelihood × impact matrix, attenuated by receipt evidence count. Returns auditor-ready Markdown. |
| build_eu_craA | Build an EU Cyber Resilience Act (Regulation (EU) 2024/2847) compliance report from a VAOS receipt set. Maps every Annex I essential cybersecurity requirement + Article 13/14 obligation to receipt-derived evidence. Surfaces open findings. |
| build_constitution_auditA | Audit a VAOS receipt set against a signed AI constitution. The constitution is a content-addressed (SHA-256) document of inviolable rules; receipts commit to its hash. This tool surfaces every receipt that violated a constitutional article, ranked by severity. Use it when you want to prove (or disprove) an autonomous agent followed its policy. |
| create_constitutionA | Sign a new AI constitution. Returns a SignedConstitution whose |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each build_* tool targets a named, distinct regulatory framework (Annex IV, ISO 42001, NIST AI RMF, SOC 2, GDPR DPIA, HIPAA, ISO 23894, EU CRA), so selection is mostly clear from the name alone. The only real friction is the cluster of AI-risk/governance reports (build_iso_23894 vs build_nist_ai_rmf, build_annex_iv vs build_iso_42001), where an agent must read descriptions to pick the right one.
All tools are snake_case verb_noun with a small set of verbs (verify_, create_, build_) used uniformly. The pattern is predictable: build_<framework> for report generation, verify_/create_ for the manifest and constitution primitives.
11 tools sits squarely in the well-scoped range. Each build_* tool corresponds to a genuinely different compliance artifact rather than being a redundant variant, and the two non-build tools (verify_manifest, create_constitution) anchor the receipt/constitution lifecycle.
The report surface is broad, but the underlying receipt lifecycle has notable gaps: there is no create_receipt or list/get_receipt, no verify_constitution or verify_receipt equivalent, and verify_manifest explicitly does not check the ML-DSA-65 half of v3 signatures. Agents can build reports but have limited ability to inspect, verify, or manage the receipt sets and constitutions they depend on.