Skip to main content
Glama
uchit

Regulated AI Compliance

by uchit

mcp-regulated-ai-compliance

A Model Context Protocol server exposing the regulated-industry AI compliance knowledge from hellouchit.com as tools, resources, and prompts callable from any MCP-compatible AI client — Claude Desktop, Cursor, Zed, Windsurf, OpenAI ChatGPT, Continue, Cline, and ~40 other clients.

Free + open-source (Apache 2.0, dataset CC BY 4.0). Built by Uchit Vyas.

Disclaimer: This is a personal, open-source, non-commercial project. Views are my own. It is not affiliated with, endorsed by, or representative of my employer.


Why this exists

The OpenAI GPT Store hosts the EU AI Act and AU AI Safety Standard coaches as ChatGPT-only assets. The Claude Project equivalents are private to each user's Claude Pro account (no public sharing). Neither reaches the practitioners who work primarily inside Cursor, Zed, Continue, Cline, or the Claude API directly.

An MCP server is the only Claude-side asset that is genuinely shareable + multi-client. It surfaces the same dataset, anti-patterns, decision trees, and classification logic — but as tools any AI agent in any compatible client can call. One published server → 40+ client surfaces → the practitioner who never opens ChatGPT or claude.ai still ends up citing your work.


Related MCP server: ActTrace

What's in this folder

mcp-regulated-ai-compliance/
├── README.md                          ← you are here
├── scope/                             ← the design docs (read FIRST)
│   ├── 00-product-brief.md            What this is + who it's for
│   ├── 01-architecture.md             System design + transport choices
│   ├── 02-tools-spec.md               The 10 tools the server exposes
│   ├── 03-resources-spec.md           The resources + prompts
│   ├── 04-distribution-strategy.md    Where to list + how to get installs
│   └── 05-build-roadmap.md            v0.1 → v1.0 in 4 phases
├── src/
│   ├── index.ts                       ← MCP server entry point (working stub)
│   ├── tools/                         ← one file per tool
│   │   └── lookup-control.ts          ← FULLY IMPLEMENTED as reference
│   ├── resources/                     ← one file per resource type
│   ├── prompts/                       ← pre-built prompt templates
│   ├── data/                          ← embedded knowledge (dataset, anti-patterns, playbooks)
│   │   ├── dataset.json               ← 56 controls × 28 regulations × 261 tools
│   │   ├── dataset.csv                ← same data, CSV format
│   │   ├── anti-patterns.md           ← 15 named failure modes
│   │   └── playbooks/                 ← 90-day playbooks
│   └── lib/
├── docs/
│   └── install/                       ← per-client install guides
├── examples/                          ← sample conversations / use-cases
├── tests/
├── package.json                       ← npm config (working)
├── tsconfig.json                      ← TypeScript config
├── LICENSE                            ← Apache 2.0 (code) + CC BY 4.0 (dataset)
├── .gitignore
└── .github/workflows/                 ← CI: build + publish to npm

Status — v0.2.1 shipped 2026-05-29

v0.2.1 = data-source abstraction so the same codebase runs on Node (stdio, node:http) AND on Cloudflare Workers / Deno Deploy / Vercel Edge. See worker/ for the Cloudflare scaffold.

CI npm version npm downloads License: Apache 2.0 Provenance MCP Registry Glama MCP score

Phase

Status

Phase 0 — Scope + skeleton

✅ done

Phase 1 — Working server + reference tool

✅ done

Phase 2 — 6 core tools

✅ done

Phase 3 — 4 resource providers + 5 prompts

✅ done

Phase 4 — npm publish + directory submissions

✅ done

Phase 5 — HTTP transport + 4 playbooks + parser

done (v0.2.0)

v0.2.0 ships with

  • Streamable HTTP transportnpx mcp-regulated-ai-compliance-http boots a Node HTTP server on port 3000 (configurable) at /mcp. Unlocks Smithery, ChatGPT MCP directory, browser-based clients, and any platform that prefers HTTP over stdio. Stateless by default; set MCP_STATEFUL=true for per-session UUIDs.

  • All 4 playbooks fully structured — markdown parser extracts 12-week / 12-gate / phase / anti-pattern / source-URL data:

    • eu-ai-act-12-weeks — Piloting → Articles 9-15 ready by 2 Aug 2026

    • cisa-attestation-90-days — Federal contractor SSDF + Common Form 3201-NEW

    • cloud-cost-aware-to-controlled — FinOps Aware → Controlled (AWS / Azure / GCP)

    • vault-theatre-to-workload-identity — Long-lived creds → OIDC federation

  • 6 toolslookup_control · get_anti_pattern · crosswalk · walk_playbook · classify_use_case · list_regulations

  • 4 resource providers (56 URIs) — full dataset (+ by-regulation + by-category), 15 anti-patterns (bundled + per-slug), 4 playbooks, the 20-entry crosswalk matrix

  • 5 promptseu-ai-act-classify · au-ai-safety-walkthrough · crosswalk-frameworks · playbook-week · anti-pattern-diagnostic

  • Embedded knowledge — 56 controls × 28 regulations × 261 tools, 15 named anti-patterns, 4 × 12-week playbooks, 20 crosswalks

  • CI + tests — GitHub Actions on Node 22 + 24, 24/24 unit tests, automated npm publish --provenance on version tag (sigstore-anchored)

Where you can find it

Channel

Status

npm

@hellouchit/mcp-regulated-ai-compliance@0.2.0

Official MCP Registry

io.github.uchit/mcp-regulated-ai-compliance@0.2.1 (latest)

Glama

verified

mcp.so

⏳ awaiting review

PulseMCP

⏳ auto-pulls from Official Registry (~24h)

awesome-mcp-servers (Security)

PR #7084

Hosted endpoint

https://mcp.hellouchit.com/mcp (Cloudflare Worker · stateless)

Smithery

smithery.ai/server/@uchit86/regulated-ai-compliance

See scope/05-build-roadmap.md for the v0.2+ roadmap.


Quick install

For Claude Desktop:

# In your Claude Desktop config file (~/Library/Application Support/Claude/claude_desktop_config.json):
{
  "mcpServers": {
    "regulated-ai-compliance": {
      "command": "npx",
      "args": ["-y", "@hellouchit/mcp-regulated-ai-compliance"]
    }
  }
}

Then restart Claude Desktop → you'll see new tools available: lookup_control, classify_use_case, get_anti_pattern, etc.

Regulation slugs (use these exact values in tool arguments)

eu_ai_act · cps234 · cps230 · soci · ai_safety_au · privacy_au · e8 · irap · dora · nis2 · gdpr · circia · hipaa · fda_samd · cisa_ssa · ssdf · ai_rmf · sp80053 · iso42001 · iso27001 · slsa · owasp_llm · atlas · bcbs239 · pci · iec62443 · iso13485 · iec62304


Local development

npm install
npm run build
npm run dev          # runs server in dev mode (stdio transport)
npm test             # runs the test suite

See scope/01-architecture.md for the dev-loop details.


License

Code: Apache 2.0. Patent grant included. Dataset (regulations × controls × tooling, anti-patterns, playbooks, crosswalks): CC BY 4.0 — attribution to hellouchit.com required.

This is a personal, non-commercial project shared for the community. Contributions and issues are welcome on GitHub.

Available Tools

6 tools
classify_use_caseA

Classify an AI use-case under EU AI Act (Annex III + Article 5) and optionally AU AI Safety Standard.

Returns: risk tier, matching Annex III categories with sub-points, applicable Articles 9-15 obligations, enforcement date, and a recommended next-step sequence (which other tools to call).

Use for: initial classification of a new use-case, dual-jurisdiction analysis (EU + AU), or generating a structured input for the human-counsel-review handoff.

Not a substitute for legal counsel — borderline cases (especially employment, essential services, credit) need qualified review.

ParametersJSON Schema
NameRequiredDescriptionDefault
descriptionYesFree-text AI use-case description. Be specific about: what the AI does, who it affects, what decisions it influences, what data it uses. Minimum 20 chars.
jurisdictionsNoJurisdictions to classify against. Default: EU AI Act only. Pass ['EU','AU'] for dual-framework classification.

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the tool is not a substitute for legal counsel and mentions it recommends a next-step sequence. However, it does not explicitly state that the tool is read-only or has no side effects. Adequate but not extensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three well-structured paragraphs: function and output, use cases, and a caveat. Information is front-loaded with the key purpose and returns. No redundant phrases; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains the return (risk tier, categories, obligations, next steps). It addresses dual-jurisdiction complexity. Could be slightly more detailed on output format, but sufficient for an AI agent. Context signals (2 params, no annotations) are well-covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions. The description adds value by advising on specificity for the 'description' parameter (e.g., what the AI does, data used) and explaining the 'jurisdictions' default and dual-framework option. This enhances schema information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool classifies AI use-cases under EU AI Act and optionally AU AI Safety Standard, listing specific outputs (risk tier, categories, obligations, etc.). It distinguishes from sibling tools like crosswalk or list_regulations by focusing on initial classification and dual-jurisdiction analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists use cases: initial classification, dual-jurisdiction analysis, and structured input for human-counsel-review. Includes caveat about not being a substitute for legal counsel and notes borderline cases needing review. Lacks direct comparison to siblings but provides clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

crosswalkA

Map a regulatory requirement to its equivalents across other frameworks. Covers: EU AI Act ↔ NIST AI RMF ↔ ISO/IEC 42001 ↔ AU AI Safety Standard ↔ APRA CPS 230/234 ↔ OECD AI Principles ↔ Council of Europe Framework Convention on AI ↔ GDPR ↔ SLSA ↔ NIST SSDF ↔ OWASP LLM Top 10.

Each mapping has overlap classification (FULL · PARTIAL · NEW) plus practitioner notes on why.

Use whenever a user has work in one framework and needs to know what carries over to another. Highest-leverage when multinationals operating across jurisdictions need to demonstrate 'work done once counts everywhere'.

Source data maintained at hellouchit.com/dataset/. Set list_all_frameworks=true to see the framework catalogue first if you're unsure of the slugs.

ParametersJSON Schema
NameRequiredDescriptionDefault
from_frameworkNoSource framework slug (e.g. 'eu_ai_act', 'au_ai_safety', 'nist_ai_rmf', 'iso_42001', 'apra_cps_230', 'ssdf'). If omitted with from_reference, searches across all frameworks.
from_referenceNoSource requirement reference (e.g. 'Article 9', 'G2', 'MAP 1.1', 'A.6.1', '§13', 'PS.3'). Case-insensitive substring match against entry references.
to_frameworksNoTarget frameworks to map TO. If omitted, returns mappings to all available target frameworks.
overlap_filterNoFilter results by overlap strength.
list_all_frameworksNoIf true, ignore other parameters and return the framework catalogue.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries the transparency burden. It discloses that mappings include overlap classification (FULL/PARTIAL/NEW) and practitioner notes. It also reveals that source data is maintained externally. However, it does not mention any restrictions, permissions, or more detailed output expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: purpose first, then framework list, then usage guidance, then source hint. It is somewhat lengthy but each sentence carries important information. A minor trim of the framework list could improve conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 parameters and no output schema or annotations, the description covers key aspects: mapping behavior, classification, list_all_frameworks fallback, and data source. It could mention that results are returned as a mapping list, but overall it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the description adds significant semantic value: it explains the interaction between from_framework and from_reference (searches across all if from_framework omitted with from_reference), that to_frameworks filters targets, and that list_all_frameworks overrides all other parameters. This exceeds the schema's brief descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Map a regulatory requirement to its equivalents across other frameworks.' It enumerates covered frameworks and provides context about mapping classification, which clearly distinguishes it from sibling tools like classify_use_case or list_regulations that perform different functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use: 'Use whenever a user has work in one framework and needs to know what carries over to another.' It also identifies high-leverage scenarios and explains the list_all_frameworks fallback for unsure users. This provides strong usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_anti_patternA

Look up anti-patterns from the catalogue at hellouchit.com/anti-patterns/ — named failure modes that recur across regulated-industry tech delivery.

Each match returns: where the pattern appears, why it's bad, what to do instead, and a diagnostic 'tell' that surfaces it. Examples: 'Inline Prompt Pattern', 'AI CoE Trap', 'Vault Theatre', 'SBOM Shelfware', 'PDF Principles', 'Eval Set That Never Runs'.

Use when reviewing an architecture description or codebase to flag known failure shapes; or when you need to name a problem precisely for a stakeholder conversation.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesSearch query. Can be a name ('AI CoE Trap'), slug ('vault-theatre'), or keyword ('inline prompt', 'static credentials'). Case-insensitive substring search.
list_allNoIf true, ignore query and return all known anti-patterns. Useful for catalogue browsing.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description details the return structure (where, why, what to do, diagnostic tell) and provides examples, effectively disclosing the tool's read-only lookup behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence serves a purpose: purpose, return structure, examples, and usage. No fluff, well-organized, and front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description explains return fields. Parameters are fully covered. Minor gap: no mention of permissions or authentication, but this is not critical for a lookup tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already describes both parameters well. The description adds value with example queries, but this is not essential beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool looks up anti-patterns from a specific catalogue, provides examples of anti-pattern names, and implicitly distinguishes from siblings focused on regulations and controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when to use the tool—'when reviewing an architecture description or codebase' and 'when you need to name a problem precisely'—but does not specify when not to use it or mention alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_regulationsA

Return the regulations covered by the dataset. Useful as a discovery step — call this first to find available regulation slugs before calling lookup_control or crosswalk.

Each entry includes: slug (for use with other tools), full label, jurisdiction (AU/EU/US/INTL), and the count of control rows that reference it.

ParametersJSON Schema
NameRequiredDescriptionDefault
jurisdictionNoFilter by jurisdiction. Default: all.all
include_row_countNoInclude how many control rows in the dataset reference each regulation.

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description is the sole source. It discloses the output structure (slug, label, jurisdiction, row count) but does not mention behavioral traits like idempotency, rate limits, or permissions. For a simple list tool, this is adequate but not exceptional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two well-structured sentences. The first states the main purpose, the second details output fields and usage. No wasted words, front-loaded with key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with full schema coverage and no output schema, the description adequately covers what the tool does, when to use it, and what the response contains. It is complete given the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline 3. The description does not add additional meaning for the parameters beyond what is already in the schema, focusing instead on output fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns regulations covered by the dataset, using the verb 'return' and specifying the resource. It distinguishes itself from siblings by highlighting its role as a discovery step for other tools like lookup_control and crosswalk, which adds context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises calling this tool first before other tools, mentioning lookup_control and crosswalk by name. This provides clear usage context, though it lacks explicit 'when not to use' guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lookup_controlA

Look up which security/compliance controls apply for a given regulation, control category, enforcement surface, and/or sector.

Each result includes: the named control, the regulations that mandate it, the tooling options that implement it (categorised as managed/oss/commercial/standard), the evidence shape an auditor would expect, sector relevance, and a practitioner note.

Sourced from the curated dataset at hellouchit.com/dataset/ (CC BY 4.0). Covers EU AI Act, NIST AI RMF, ISO/IEC 42001, APRA CPS 234/230, AU AI Safety Standard, ASD Essential Eight, IRAP, SLSA, NIST SSDF, OWASP LLM Top 10, MITRE ATLAS, BCBS 239, PCI DSS 4.0, HIPAA, GDPR, EU DORA, EU NIS2, CISA SSA, FDA SaMD, IEC 62443, and more.

Use this tool whenever you need to answer 'which tool closes X regulator's requirement on Y surface' or 'what evidence does Z compliance regime expect'.

ParametersJSON Schema
NameRequiredDescriptionDefault
regulationNoRegulation slug. One of: cps234, cps230, soci, ai_safety_au, privacy_au, e8, irap, eu_ai_act, dora, nis2, gdpr, circia, hipaa, fda_samd, cisa_ssa, ssdf, ai_rmf, sp80053, iso42001, iso27001, slsa, owasp_llm, atlas, bcbs239, pci, iec62443, iso13485, iec62304
surfaceNoEnforcement surface keyword (case-insensitive substring match). Examples: 'Cloud', 'CI/CD', 'K8s', 'Network', 'Runtime', 'Source'
categoryNoControl category. Examples: 'Identity & access', 'Supply chain & provenance', 'AI evals & guardrails', 'Data governance', 'Cryptography & secrets', 'Resilience & continuity'
sectorNoSector filter. One of: banks, government, healthcare, critical-infrastructure, all
searchNoFree-text search over control names + notes + evidence shape
limitNoMaximum number of matches to return (default 10)

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full burden. It discloses result contents (control, regulations, tooling, evidence shape, sector relevance, practitioner note) and data source (hellouchit.com, CC BY 4.0). It does not mention any non-obvious behaviors like rate limits or permissions, but as a read-only lookup, this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-structured: first sentence states purpose, followed by result details, source, and usage examples. It is front-loaded with the key action. Minor redundancy (listing regulations again at the end) could be trimmed, but overall effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no required fields, and no output schema, the description adequately explains the return format ('Each result includes...') and the scope of data (list of regulations). It is sufficient for an agent to understand what the tool returns and when to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already describes parameters. The description adds value by giving concrete examples for 'surface' and 'category' and explaining the 'search' field semantics (free-text over control names, notes, evidence shape). This extra context justifies a score above baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb ('Look up') and resource ('security/compliance controls'), listing the dimensions (regulation, category, surface, sector). It clearly distinguishes this lookup tool from siblings like classify_use_case or walk_playbook.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool with example queries ('which tool closes X regulator's requirement on Y surface'). It does not explicitly state when not to use, but the examples and sibling names provide sufficient context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

walk_playbookA

Return a structured 90-day playbook (or specific week/gate from one). Playbooks are sequenced from week 1 to week 12, organised into 3 phases, with 12 named gates and anti-pattern callouts. Available playbooks:

  • eu-ai-act-12-weeks: From 'Piloting' to EU AI Act Articles 9-15 ready by 2 Aug 2026

  • cisa-attestation-90-days: From 'some SSDF practices' to defensible CISA Secure Software Attestation

  • cloud-cost-aware-to-controlled: From 5-12% YoY savings to 20-35% (FinOps Aware → Controlled)

  • vault-theatre-to-workload-identity: From static-creds-in-vault to OIDC workload identity Use to walk a user through implementation sequentially, or to extract a specific gate's requirements.

ParametersJSON Schema
NameRequiredDescriptionDefault
playbookYesPlaybook slug. Available: eu-ai-act-12-weeks · cisa-attestation-90-days · cloud-cost-aware-to-controlled · vault-theatre-to-workload-identity
weekNoSpecific week number (1-12). If omitted, returns the full playbook structure with metadata.
include_metadataNoInclude playbook-level metadata (audience, prerequisites, end-state, diagnostic to re-run).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description adequately discloses that the tool retrieves playbook data without side effects. It does not specify authentication or rate limits, but for a read-only retrieval tool, the transparency is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise, front-loaded with the core purpose, uses a bullet list for playbooks, and every sentence adds necessary information. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 parameters, no output schema), the description fully covers what the tool does, how to use it, and the structure of the data returned. No gaps identified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions. The description adds extra context: explains the playbook structure (3 phases, 12 gates) and elaborates on the playbook parameter with real-world transformations. Adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a structured 90-day playbook or a specific week/gate, and lists available playbooks with context. It distinguishes from siblings like classify_use_case and crosswalk.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Use to walk a user through implementation sequentially, or to extract a specific gate's requirements.' It does not provide exclusions or alternatives, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a distinctly unique purpose: classification, cross-referencing, anti-pattern lookup, regulation listing, control lookup, and playbook generation. No two tools overlap in functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern with lowercase and underscores (e.g., classify_use_case, list_regulations). Even 'crosswalk' as a verb works similarly. No mixing of conventions.

Tool Count5/5

With 6 tools, the server covers key compliance workflows without being bloated or sparse. Each tool serves a clear role in the domain of regulated AI compliance.

Completeness4/5

The tool set covers core tasks: classification, cross-mapping, anti-pattern identification, regulatory discovery, control lookup, and implementation playbooks. Minor gaps like compliance reporting or audit trail tools are absent but not critical for the stated purpose.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    MCP server for compliance automation of AI agents, enabling EU AI Act compliance, verifiable credentials, and decentralized identity management with 47 tools across 9 modules.
    17
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server providing immutable audit logging, policy enforcement, and compliance reporting for AI agent workflows, enabling regulatory compliance and chain integrity verification.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/uchit/mcp-regulated-ai-compliance'

If you have feedback or need assistance with the MCP directory API, please join our Discord server