Skip to content
Agentmart
Submit a tool

ClevSec EU compliance tools

Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.

Connector by clevsec.oneOfficial · Domain verified by the MCP Registry

IndexedLicense unknownRemote (HTTP)
Write a review

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/clevsec-one-eu-compliance

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://mcp.clevsec.one/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
28 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 28

From the running server's own tool list (tools/list) on Oct 25, 2026.

Read 28 · Look things up without changing anything.

  • cookie_consent_check
  • cookie_consent_fix_plan
  • cra_reporting_check
  • cyber_risk_action_plan
  • cyber_risk_score
  • data_flow_record_check
  • data_flow_review
  • dora_checklist
  • dora_classify_incident
  • dora_gap_assessment
  • dora_remediation_plan
  • gdpr_breach_decision
Show 16 more tools
  • gdpr_checklist_assessment
  • gdpr_dpia_report
  • gdpr_dpia_screening
  • gdpr_fine_estimate
  • gdpr_remediation_plan
  • iso27001_gap_assessment
  • iso27001_remediation_plan
  • maturity_assessment
  • maturity_improvement_plan
  • nis2_gap_assessment
  • nis2_remediation_plan
  • nis2_scope_check
  • privacy_notice_requirements
  • reporting_deadlines
  • vendor_due_diligence_plan
  • vendor_risk_assessment

Network hosts it talks to 1

  • mcp.clevsec.one · found in remote endpoint, install command

Files it touches

  • Any path the agent passes to its tools

Tools (28)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • cookie_consent_checkCookie consent compliance checkread-only

    Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to get the checklist items by area, critical ones marked. Call with yes, partial or no per item to get a score, a compliance label and the open items.

  • cookie_consent_fix_planCookie consent fix plan (ClevSec Pro)read-only

    Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Planet49, EDPB) and a 30/60/90-day roadmap. Requires ClevSec Pro.

  • cra_reporting_checkCyber Resilience Act: must the manufacturer report?read-only

    Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.

  • cyber_risk_action_planCyber risk action plan (ClevSec Pro)read-only

    Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references and a 30/60/90-day roadmap (MFA, encryption, patching, incident response and backups first). Requires ClevSec Pro.

  • cyber_risk_scoreCyber risk score (15 key controls)read-only

    Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted questions on access, data, systems, people, incident response and backups. Call with yes, partial or no per question to get a 0-100 score, a risk level and a score per category.

  • data_flow_record_checkGDPR data flow and Art. 30 record checkread-only

    Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recipients, legal basis, retention, transfers); returns, per flow, what an Art. 30 record still lacks, plus the allowed values for categories, legal bases and safeguards.

  • data_flow_reviewGDPR data flow compliance review (ClevSec Pro)read-only

    Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate interest records, retention, international transfer tools and transfer impact assessments, and DPIA need, with an action, GDPR article and 30/60/90-day roadmap. Requires ClevSec Pro.

  • dora_checklistDORA requirements checklistread-only

    Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.

  • dora_classify_incidentDORA major ICT-related incident checkread-only

    Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know.

  • dora_gap_assessmentDORA readiness gap assessmentread-only

    Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, incident management, resilience testing, ICT third-party risk, information sharing), each with its DORA article. Call with answers (yes, partial, no per question id) to get a score per pillar, an overall readiness level and the gaps.

  • dora_remediation_planDORA remediation plan (ClevSec Pro)read-only

    Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, the DORA article and a 30/60/90-day roadmap (ICT risk management and incident management first). Requires ClevSec Pro.

  • gdpr_breach_decisionGDPR data breach: who must be notified?read-only

    Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.

  • gdpr_checklist_assessmentGDPR compliance checklistread-only

    Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 areas (lawfulness, transparency and rights, minimisation and retention, security, breaches, processors, accountability, international transfers), each with its article. Call with the ids done (and optional items not applicable) to get the completion score and the open items.

  • gdpr_dpia_reportGDPR DPIA report and action plan (ClevSec Pro)read-only

    Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indicative residual risk, and every gap (legal basis, special category data, necessity, missing measures, transfers, prior consultation under Art. 36) with an action, priority, article and a 30/60/90-day roadmap. Requires ClevSec Pro.

  • gdpr_dpia_screeningGDPR DPIA screening and risk summaryread-only

    Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is. Applies GDPR Art. 35(3), national lists and the nine WP248 rev.01 criteria, scores necessity and mitigation, and gives an indicative residual risk. Call without input to get the questions; every input is optional.

Show 13 more tools
  • gdpr_fine_estimateGDPR fine starting range (EDPB method)read-only

    Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine.

  • gdpr_remediation_planGDPR remediation plan (ClevSec Pro)read-only

    Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a priority, the GDPR article and a 30/60/90-day roadmap (lawfulness, records, breach handling and processor contracts first). Requires ClevSec Pro.

  • iso27001_gap_assessmentISO 27001 readiness gap assessmentread-only

    Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 control checks in four themes (organizational, people, physical, technological) with their Annex A references. Call with a status per control (implemented, partial, planned, not_impl) to get a score per theme, a readiness level and the gaps.

  • iso27001_remediation_planISO 27001 remediation plan (ClevSec Pro)read-only

    Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended action, a priority, the Annex A control and a 30/60/90-day roadmap (organizational controls first). Requires ClevSec Pro.

  • maturity_assessmentCybersecurity maturity assessment (NIST CSF 2.0)read-only

    Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF functions and the 1-5 levels. Call with a level per capability to get the average per function and an overall maturity level.

  • maturity_improvement_planCybersecurity maturity improvement plan (ClevSec Pro)read-only

    Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF 2.0 subcategory, NIS2 article and a 30/60/90-day roadmap (govern and identify first). Requires ClevSec Pro.

  • nis2_gap_assessmentNIS2 readiness gap assessmentread-only

    Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps.

  • nis2_remediation_planNIS2 remediation plan (ClevSec Pro)read-only

    Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, the NIS2 article and a 30/60/90-day roadmap (governance, risk and incident gaps first). Requires ClevSec Pro.

  • nis2_scope_checkDoes NIS2 apply, and is the entity essential or important?read-only

    Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide.

  • privacy_notice_requirementsGDPR privacy notice: what it must containread-only

    Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need.

  • reporting_deadlinesEU incident and breach reporting deadlinesread-only

    Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts.

  • vendor_due_diligence_planVendor due diligence plan and contract clauses (ClevSec Pro)read-only

    Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 27001 / GDPR / NIS2 / DORA references and a roadmap (before signing first), plus the contract clauses to include (GDPR Art. 28, NIS2 Art. 21, DORA Art. 30 when they apply). Requires ClevSec Pro.

  • vendor_risk_assessmentVendor security risk assessmentread-only

    Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or DORA). Call without input to get the questions. Call with the vendor profile (type, criticality, data access, regimes) and answers (yes, partial, no, unknown) to get a risk score, risk level, monitoring tier and the gaps.

Signals

Last release
Oct 22, 2026 (6 days ago)

Details

Registry name
one.clevsec/eu-compliance
Version
1.2.1
Auth
Auth not stated
License
License unknown
Website
clevsec.one/mcp/
First seen
Oct 24, 2026
Last checked
Oct 25, 2026
Source
Official MCP Registry
Cite this page

ClevSec EU compliance tools MCP server. Agent Mart. https://agentmart.dev/connectors/clevsec-one-eu-compliance (last updated 2026-10-25)