Receipts Compliance MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| verify_manifestA | Verify a signed receipt bundle manifest (MANIFEST.signed.json) against an Ed25519 public key. Recomputes the manifest hash and checks the signature. Use before building a report from a receipt set you did not produce yourself. Does not check the ML-DSA-65 half of a v3 signature. |
| build_annex_ivA | Build an EU AI Act Annex IV technical-documentation report from a set of VAOS receipts. Article 11 of Regulation (EU) 2024/1689 requires this for every high-risk AI system. Returns Markdown ready to file with the EU AI Office. |
| build_iso_42001A | Build an ISO/IEC 42001:2023 AI management system (AIMS) report from a set of VAOS receipts. Covers clauses 4-10 + the 38-control Annex A matrix. Returns Markdown ready to hand to your certification body (BSI, TÜV SÜD, etc.). |
| build_nist_ai_rmfA | Build a NIST AI RMF 1.0 profile (GOVERN / MAP / MEASURE / MANAGE) from a set of VAOS receipts. The de-facto US federal AI risk-management standard. Returns Markdown with per-subcategory evidence counts and trustworthy-AI characteristic coverage. |
| build_soc2_evidenceA | Build a SOC 2 evidence binder mapped to AICPA Trust Service Criteria (2017) — security (CC1-CC9), availability (A1), processing integrity (PI1), confidentiality (C1), privacy (P-series). Each criterion gets a receipt-derived evidence count + days-of-coverage metric. Returns Markdown to walk into the audit kickoff with. |
| build_gdpr_dpiaA | Build a GDPR Article 35 DPIA + Article 30 RoPA report from operator-declared processing activities + a VAOS receipt set. Returns Markdown ready for the DPO + supervisory authority. High-residual-risk activities automatically flagged for Article 36 prior consultation. |
| build_hipaa_securityA | Build a HIPAA Security Rule (45 CFR § 164.308-318) evidence binder from a set of VAOS receipts. Maps every implementation specification to receipt-derived evidence. REQUIRED specifications without evidence are surfaced as findings; ADDRESSABLE specifications can be marked alternative-implemented with an operator note. |
| build_iso_23894A | Build an ISO/IEC 23894:2023 AI risk-management report from operator-declared risk scenarios + a VAOS receipt set. Computes inherent + residual risk per scenario via the 5×5 likelihood × impact matrix, attenuated by receipt evidence count. Returns auditor-ready Markdown. |
| build_eu_craA | Build an EU Cyber Resilience Act (Regulation (EU) 2024/2847) compliance report from a VAOS receipt set. Maps every Annex I essential cybersecurity requirement + Article 13/14 obligation to receipt-derived evidence. Surfaces open findings. |
| build_constitution_auditA | Audit a VAOS receipt set against a signed AI constitution. The constitution is a content-addressed (SHA-256) document of inviolable rules; receipts commit to its hash. This tool surfaces every receipt that violated a constitutional article, ranked by severity. Use it when you want to prove (or disprove) an autonomous agent followed its policy. |
| create_constitutionA | Sign a new AI constitution. Returns a SignedConstitution whose |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
The three non-report tools (create_constitution, build_constitution_audit, verify_manifest) are clearly distinct, and each build_* report tool names its target framework explicitly. However, eight tools share the identical shape 'build a Markdown compliance report from a receipt set,' so selection depends entirely on the agent knowing which regulatory framework applies—an easy source of misselection.
Every tool is snake_case with a leading verb (build_, create_, verify_) followed by a noun describing the target artifact or standard. The build_* family is uniform, and the two non-build tools still follow verb_noun convention.
Eleven tools sits comfortably in the well-scoped 3–15 range. The count is driven by distinct regulatory frameworks rather than redundant variants, and each report tool targets a genuinely different standard.
Framework reporting coverage is broad (EU AI Act, ISO 42001, NIST, SOC 2, GDPR, HIPAA, ISO 23894, CRA), but the receipt and constitution lifecycle is thin: no tool to list/fetch receipts, retrieve or list constitutions, or verify an individual receipt (only a whole manifest, and only the Ed25519 half of v3 signatures). Agents can work around this if receipts are supplied externally, but the surface has notable dead ends.