ClevSec EU compliance tools MCP Server

by clevsec Your server? Claim it

answering

ClevSec EU compliance tools is answering right now. Last checked 3 min ago. It exposes 29 tools.

Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.

Uptime history 13 days of history

13 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

196 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 4

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 22 October 2026. No other catalogue keeps this.

2 Nov a tool appeared agent_risk_check

2 Nov a tool changed version

23 Oct a tool description was rewritten gdpr_checklist_assessment

22 Oct a tool changed version

Nothing serious here today

Today is the operative word: we check ClevSec EU compliance tools every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 3 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add eu-compliance --transport http https://mcp.clevsec.one/mcp

Settings → Connectors → Add custom connector, then paste this address

https://mcp.clevsec.one/mcp

~/.codex/config.toml

[mcp_servers.eu-compliance]
url = "https://mcp.clevsec.one/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "eu-compliance": {
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "eu-compliance": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

Available tools 29

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

gdpr

gdpr_breach_decision

Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.

gdpr_checklist_assessment

Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 areas (lawfulness, transparency and rights, minimisation and retention, security, breaches, processors, accountability, international transfers), each with its article. Call with the ids done (and optional items not applicable) to get the completion score and the open items.

gdpr_dpia_report

Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indicative residual risk, and every gap (legal basis, special category data, necessity, missing measures, transfers, prior consultation under Art. 36) with an action, priority, article and a 30/60/90-day roadmap. Requires ClevSec Pro.

gdpr_dpia_screening

Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is. Applies GDPR Art. 35(3), national lists and the nine WP248 rev.01 criteria, scores necessity and mitigation, and gives an indicative residual risk. Call without input to get the questions; every input is optional.

gdpr_fine_estimate

Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine.

gdpr_remediation_plan

Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a priority, the GDPR article and a 30/60/90-day roadmap (lawfulness, records, breach handling and processor contracts first). Requires ClevSec Pro.

dora

dora_checklist

Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.

dora_classify_incident

Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know.

dora_gap_assessment

Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, incident management, resilience testing, ICT third-party risk, information sharing), each with its DORA article. Call with answers (yes, partial, no per question id) to get a score per pillar, an overall readiness level and the gaps.

dora_remediation_plan

Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, the DORA article and a 30/60/90-day roadmap (ICT risk management and incident management first). Requires ClevSec Pro.

nis2

nis2_gap_assessment

Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps.

nis2_remediation_plan

Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, the NIS2 article and a 30/60/90-day roadmap (governance, risk and incident gaps first). Requires ClevSec Pro.

nis2_scope_check

Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide.

cookie_consent_check

Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to get the checklist items by area, critical ones marked. Call with yes, partial or no per item to get a score, a compliance label and the open items.

cookie_consent_fix_plan

Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Planet49, EDPB) and a 30/60/90-day roadmap. Requires ClevSec Pro.

cyber

cyber_risk_action_plan

Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references and a 30/60/90-day roadmap (MFA, encryption, patching, incident response and backups first). Requires ClevSec Pro.

cyber_risk_score

Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted questions on access, data, systems, people, incident response and backups. Call with yes, partial or no per question to get a 0-100 score, a risk level and a score per category.

data

data_flow_record_check

Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recipients, legal basis, retention, transfers); returns, per flow, what an Art. 30 record still lacks, plus the allowed values for categories, legal bases and safeguards.

data_flow_review

Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate interest records, retention, international transfer tools and transfer impact assessments, and DPIA need, with an action, GDPR article and 30/60/90-day roadmap. Requires ClevSec Pro.

iso27001

iso27001_gap_assessment

Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 control checks in four themes (organizational, people, physical, technological) with their Annex A references. Call with a status per control (implemented, partial, planned, not_impl) to get a score per theme, a readiness level and the gaps.

iso27001_remediation_plan

Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended action, a priority, the Annex A control and a 30/60/90-day roadmap (organizational controls first). Requires ClevSec Pro.

maturity

maturity_assessment

Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF functions and the 1-5 levels. Call with a level per capability to get the average per function and an overall maturity level.

maturity_improvement_plan

Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF 2.0 subcategory, NIS2 article and a 30/60/90-day roadmap (govern and identify first). Requires ClevSec Pro.

vendor

vendor_due_diligence_plan

Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 27001 / GDPR / NIS2 / DORA references and a roadmap (before signing first), plus the contract clauses to include (GDPR Art. 28, NIS2 Art. 21, DORA Art. 30 when they apply). Requires ClevSec Pro.

vendor_risk_assessment

Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or DORA). Call without input to get the questions. Call with the vendor profile (type, criticality, data access, regimes) and answers (yes, partial, no, unknown) to get a risk score, risk level, monitoring tier and the gaps.

agent

agent_risk_check

Use when someone asks how risky an AI agent or assistant setup is ('is it safe to let our agent read email and send replies?', 'what are the risks of this agent?'). Call without answers to get 9 questions on what the agent can do and 11 on the controls that limit it. Call with answers to get a 0-100 residual risk score (0 = lowest), a risk level, red flags such as an exfiltration path, and the missing controls with actions and OWASP, GDPR and AI Act references. A self-assessment from the user's answers, not a scan or test of the agent.

cra

cra_reporting_check

Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.

privacy

privacy_notice_requirements

Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need.

reporting

reporting_deadlines

Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts.

Endpoints

URL	Transport	State	Latency	Checked
https://mcp.clevsec.one/mcp	streamable-http	answering	135 ms	3 min ago

Alternatives to ClevSec EU compliance tools

same job, measured the same way

Meok Enterprise Compliance Suite

by csoai-org

MEOK Enterprise Compliance Suite — End-to-end EU AI Act, GDPR, NIS2, DORA, ISO, SOC2, HIPAA, PCI

50 installs/wk local only

meok-eu-cra-mcp

by csoai-org

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server. 4 tools, 11 tests. A

108 installs/wk local only

Atomadic MCP

by atomadic

Atomadic MCP: 68 deterministic tools for agent identity, escrow, SLA, EU AI Act compliance.

68 tools answering

Bidda Compliance

by bidda

10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).

25 tools answering

MCP Geracompliance

by geraservicesuk

EU AI Act and GDPR compliance: checks, audits, generate policies.

44 installs/wk local only

LexiShield AI — 6-Agent GDPR, EU AI Act & Contract Redlining Server

by surge-lexishield-ai

Run deterministic SaaS contract redlining, GDPR Art. 28 DPA & EU AI Act compliance audits.

4 tools answering

LexiShield AI — 6-Agent GDPR, EU AI Act & Contract Redlining Server

by run402-lexishield-ai

Run deterministic SaaS contract redlining, GDPR Art. 28 DPA & EU AI Act compliance audits.

4 tools answering

ISMS Copilot

by tristanroth1

The compliance specialist your AI calls: ISO 27001, SOC 2, GDPR, NIS 2, DORA and more.

answering

ClevSec EU compliance tools — questions

Answers built from our own checks of this server.

What can ClevSec EU compliance tools do?

It exposes 29 tools, read directly from the server on our last check. Among them: agent_risk_check, cookie_consent_check, cookie_consent_fix_plan, cra_reporting_check, cyber_risk_action_plan, cyber_risk_score and 23 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is ClevSec EU compliance tools mostly used for?

Its tools cluster around gdpr, dora and nis2. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is ClevSec EU compliance tools working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 196 ms. The bar chart above shows every period we have measured.

How do I connect ClevSec EU compliance tools?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does ClevSec EU compliance tools need an API key?

No. ClevSec EU compliance tools completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 29 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is ClevSec EU compliance tools?

It answers our handshake in 196 ms on average, which is faster than 72% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.