frag.hugo MCP Server

Lists dated compliance deadlines from the frag.hugo deadline calendar (GDPR, NIS2, AI Act, CRA, DORA, Data Act, accessibility act and more), each with legal provision, status, what to do and the official source. Without date filters it returns the next upcoming deadlines from today. Not for deadlines of an individual company (data breach, data subject request); those need an account.

Summarises how many organisations from Germany ransomware groups have named on their leak sites in the last 30 days or 12 months, by industry and group, with the frag.hugo monthly assessment and method. Counts are perpetrator claims from the RansomLook inventory (CIRCL, CC BY 4.0), not confirmed incidents. Not for looking up individual victims.

Logs a data subject request (access, erasure, rectification, restriction, portability, objection) in the connected frag.hugo account and calculates the one-month deadline of Art. 12(3) GDPR. Step 1 (without `bestaetigung`): preview with the deadline, the possible extension, a note on identity verification and a reply draft from the frag.hugo templates, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the request; the data protection officer on file is notified. It does not send anything to the requesting person. Use only for requests addressed to the user’s own organisation.

Checks the public DNS records that protect a domain against e-mail spoofing: SPF, DKIM (common selectors), DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Returns an overall assessment, one finding per check and recommendations. Use it for a company domain, not for single mailboxes. Nothing is stored. Rate limited per connection.

Searches the frag.hugo database of documented GDPR fines (Germany and Europe), each case with authority, amount, GDPR articles, a short summary and the official source. Use it for questions such as "which fines were imposed for Art. 32" or "fines against telecom companies in Germany". Not for legal advice in an individual case and not for fines under other laws. Results are sorted by date, newest first.

Prepares the data protection paperwork for introducing a new software or cloud service in the connected frag.hugo account. Step 1 (without `bestaetigung`): preview with the frag.hugo GDPR test result for the service (if reviewed), the matching template for the record of processing activities (Verarbeitungsverzeichnis) and what will be created, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates a record of processing entry and a processor agreement (AVV) entry, both submitted for review by the data protection officer. It does not approve the software and does not contact the vendor.

Lists the open data protection deadlines of the organisation connected to this frag.hugo account: data breaches with their 72-hour reporting deadline (Art. 33 GDPR), data subject requests with their one-month deadline (Art. 12(3) GDPR, incl. extensions) and records of processing or processor agreements waiting for review by the data protection officer. Returns type, deadline, status and an app link per entry — no descriptions, names or contact details. Requires a connected frag.hugo account. Not for deadlines of laws in general (use get_compliance_deadlines).

Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without `bestaetigung`): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.

Looks up whether frag.hugo has reviewed a software or cloud service for GDPR use in companies (contract partner, data processing agreement, subprocessors, data location, third-country transfer, AI training, certificates, admin controls, deletion, data subject rights). Returns the published verdict with evidence links, or, if the service has not been reviewed, the ten criteria to check yourself. It never estimates a verdict for unreviewed services.

Starts the free frag.hugo website check (Hugo Check) for a public URL: cookies and tracking before consent, consent banner, Google Fonts, privacy policy and imprint, TLS and security headers, e-mail records, accessibility and shop duties. Returns the result directly if it is ready within about 20 seconds, otherwise a scan_id for get_website_check_result. The same URL within one hour returns the same scan. Limited to 3 new checks per hour per connection. Not legal advice.

Shows the subprocessor lists of 17 widely used cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce, HubSpot, Stripe and others) as monitored daily by frag.hugo: date of the last change, number of entries, names and links to the official list and the data processing agreement. Use it to check whether a provider changed its subprocessors since a given date. Not for providers outside these 17.

Finds the competent German data protection supervisory authority by federal state, postcode (PLZ) of the main establishment or authority ID, with competence, website, key figures from the latest activity report (with evidence links), focus topics and notes for SMEs. In Bavaria, public bodies are supervised by BayLfD, companies by BayLDA. If a postcode spans two states, it asks back. Not for authorities outside Germany.

Collects what frag.hugo publishes about a vendor for a due-diligence note: e-mail security of its domain, the GDPR review verdict if one exists, the subprocessor monitor entry, documented GDPR fines matched by company name, incidents published on fraghugo.de, and optionally a website check. It gives no overall grade and does not judge the vendor; each item carries its own source. Use the company name for better fine matching.

Returns the result of a website check started with start_website_check: status per category and up to eight most important findings with explanation, or "still running". Only scans started through this connector within the last 24 hours can be fetched.