{
  "publisher": "ClevSec (https://clevsec.one)",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "description": "What changed in ClevSec's open data and MCP tools, newest first.",
  "entries": [
    {
      "date": "2026-11-10",
      "kind": "tool",
      "change": "New free tool ai_act_scope_check: whether the EU AI Act applies to one AI system or general-purpose AI model, the role (with the Art. 25 change to provider), the classification (prohibited, high-risk under Annex I or III, Art. 6(3) exception, Art. 50 transparency, minimal risk, GPAI) and each obligation with its article and the date it applies from, using the dates as amended by Regulation (EU) 2026/1744. Same rules as https://clevsec.one/tools/ai-act-scope-check/. Server version 1.5.0.",
      "tools": [
        "ai_act_scope_check"
      ]
    },
    {
      "date": "2026-11-10",
      "kind": "data",
      "change": "New dataset compliance-deadlines: dated AI Act, CRA, DORA, NIS2 and Data Act milestones for 2026-2028 with who they apply to, article references and repeat rules; also published as an iCal feed at https://clevsec.one/deadlines/eu-compliance-deadlines.ics.",
      "datasets": [
        "compliance-deadlines"
      ]
    },
    {
      "date": "2026-11-04",
      "kind": "tool",
      "change": "New free tool mcp_tools_check: flags in an MCP server's tools/list response or an A2A Agent Card (hidden or manipulative text, risky capabilities such as an exfiltration path, untrusted annotations, secrets in parameters, missing card security fields), a level per tool and a SHA-256 fingerprint. New Pro tool mcp_tools_report: an action and priority per flag, a comparison with the approved version and an inventory row. Same rules as https://clevsec.one/tools/mcp-agent-card-check/. Server version 1.4.0.",
      "tools": [
        "mcp_tools_check",
        "mcp_tools_report"
      ]
    },
    {
      "date": "2026-11-02",
      "kind": "tool",
      "change": "New free tool agent_risk_check: a 0-100 residual risk score for one AI agent from 9 capability and 11 control questions, with red flags (such as an exfiltration path) and missing controls mapped to OWASP, the GDPR and the AI Act. Same rules as https://clevsec.one/tools/agent-risk-calculator/. MCP server 1.3.0.",
      "tools": [
        "agent_risk_check"
      ]
    },
    {
      "date": "2026-10-22",
      "kind": "fix",
      "change": "Answers about one reporting regime cite only that regime's sources and link its own guide (GDPR breach, DORA incident, CRA, reporting_deadlines filtered to one regime); the reporting-deadlines dataset gains a regimes field with those sources and guides. Rules and deadlines unchanged.",
      "datasets": [
        "reporting-deadlines"
      ],
      "tools": [
        "gdpr_breach_decision",
        "dora_classify_incident",
        "cra_reporting_check",
        "reporting_deadlines"
      ]
    },
    {
      "date": "2026-10-20",
      "kind": "tool",
      "change": "ClevSec Pro over MCP: /pro endpoint behind OAuth 2.1 (sign-in with a Pro licence key) with ten Pro reports; nine more free tools.",
      "tools": [
        "nis2_remediation_plan",
        "dora_remediation_plan",
        "gdpr_remediation_plan",
        "gdpr_dpia_report",
        "data_flow_review",
        "cookie_consent_fix_plan",
        "iso27001_remediation_plan",
        "vendor_due_diligence_plan",
        "maturity_improvement_plan",
        "cyber_risk_action_plan",
        "dora_gap_assessment",
        "gdpr_checklist_assessment",
        "gdpr_dpia_screening",
        "data_flow_record_check",
        "cookie_consent_check",
        "iso27001_gap_assessment",
        "vendor_risk_assessment",
        "maturity_assessment",
        "cyber_risk_score"
      ]
    },
    {
      "date": "2026-10-20",
      "kind": "data",
      "change": "Numeric fields added next to the text: DORA materiality limits (limits) and GDPR fine tiers and turnover bands (fixed_eur, turnover_percent, up_to_eur). Values unchanged.",
      "datasets": [
        "dora-major-incident-criteria",
        "gdpr-fines"
      ]
    },
    {
      "date": "2026-10-20",
      "kind": "tool",
      "change": "MCP server at https://mcp.clevsec.one/mcp with nine free tools; listed in the MCP Registry as one.clevsec/eu-compliance.",
      "tools": [
        "reporting_deadlines",
        "nis2_scope_check",
        "nis2_gap_assessment",
        "dora_classify_incident",
        "dora_checklist",
        "gdpr_breach_decision",
        "gdpr_fine_estimate",
        "privacy_notice_requirements",
        "cra_reporting_check"
      ]
    },
    {
      "date": "2026-10-19",
      "kind": "data",
      "change": "Open data published: reporting deadlines, DORA major-incident criteria, DORA checklist, NIS2 measures, NIS2 scope, GDPR fines, GDPR transparency items (CC BY 4.0).",
      "datasets": [
        "reporting-deadlines",
        "dora-major-incident-criteria",
        "dora-checklist",
        "nis2-measures",
        "nis2-scope",
        "gdpr-fines",
        "gdpr-transparency-items"
      ]
    }
  ]
}