Name: ClevSec MCP server
Author: ClevSec

Server address

https://mcp.clevsec.one/mcp

Remote MCP server, Streamable HTTP. Free, no account or key needed, read-only. ClevSec Pro reports are at a second address, below.

What your assistant can do with it

Tool	Answers	Based on
nis2_scope_check	Does NIS2 apply, and is the organisation an essential or important entity?	NIS2 Arts. 2 to 4, Recommendation 2003/361/EC
nis2_gap_assessment	53 readiness questions in nine domains, and a score with the gaps once answered	NIS2 Arts. 20, 21 and 23
dora_classify_incident	Is an ICT incident at a financial entity major, and by when must it be reported?	Delegated Regulations (EU) 2024/1772 and 2025/301
dora_checklist	The 59 core DORA requirements, without those DORA disapplies for microenterprises or the simplified framework	DORA (Regulation (EU) 2022/2554)
gdpr_breach_decision	After a personal data breach: notify the authority within 72 hours? Tell the people affected?	GDPR Arts. 33 and 34, EDPB Guidelines 9/2022
gdpr_fine_estimate	The starting range of a GDPR fine, step by step	GDPR Art. 83, EDPB Guidelines 04/2022
privacy_notice_requirements	Everything a privacy notice must contain, when to give it, and the exceptions	GDPR Arts. 12 to 14
cra_reporting_check	Must a manufacturer report an exploited vulnerability or severe incident, by when and where?	Cyber Resilience Act Arts. 14, 69 and 71
dora_gap_assessment	39 DORA readiness questions in five pillars, and a score with the gaps once answered	DORA Arts. 5 to 45
gdpr_checklist_assessment	48 GDPR checklist items in eight areas, and the completion score with open items	GDPR, item by item
gdpr_dpia_screening	Is a data protection impact assessment required, and how high is the indicative residual risk?	GDPR Art. 35, WP248 rev.01
data_flow_record_check	What each personal data flow still lacks for the records of processing	GDPR Art. 30(1)
cookie_consent_check	Is a cookie banner and consent set-up compliant? Score and open items	ePrivacy Art. 5(3), GDPR, CJEU C-673/17
iso27001_gap_assessment	41 Annex A control checks in four themes, a readiness level and the gaps	ISO/IEC 27001:2022 Annex A
vendor_risk_assessment	A supplier's security risk score, risk level, monitoring tier and gaps	ISO 27001 Annex A, NIS2 Arts. 21 and 23, DORA Arts. 28 and 30
maturity_assessment	Cybersecurity maturity per NIST CSF 2.0 function on a 1-5 scale	NIST CSF 2.0
cyber_risk_score	A quick 0-100 cyber risk score from 15 key controls	NIST CSF 2.0, NIS2 Art. 21
agent_risk_check	A 0-100 risk score for one AI agent from what it can do and what limits it, with red flags and missing controls	OWASP Agentic and LLM Top 10, GDPR Art. 22, AI Act Annex III
ai_act_scope_check	Whether the EU AI Act applies to one AI system or model, the role, the risk class and each obligation with its date	AI Act Art. 2 to 6, 25 to 27, 50 to 55, Annexes I and III, as amended by Regulation 2026/1744
mcp_tools_check	Flags in an MCP server's tool list or an A2A Agent Card: tool poisoning, risky tools, missing security fields, plus a fingerprint	MCP spec 2026-07-28, A2A 1.0, OWASP MCP and Agentic Top 10
reporting_deadlines	All incident and breach reporting deadlines under GDPR, NIS2, DORA and the CRA	The articles listed per deadline

ClevSec Pro reports

With a ClevSec Pro subscription, your assistant can also produce the full reports from our tools. Add a second connector with the Pro address and sign in once with your licence key:

Pro address

https://mcp.clevsec.one/pro

OAuth sign-in: your assistant opens a ClevSec page where you enter your Pro licence key. We check it with LemonSqueezy and keep it only inside your encrypted access grant. The Pro address also has every free tool.

Pro tool	Report
nis2_remediation_plan	Every NIS2 gap with an action, priority, article and a 30/60/90-day roadmap
dora_remediation_plan	Every DORA gap with an action, priority, article and roadmap
gdpr_remediation_plan	Every open GDPR item with an action, article and roadmap
gdpr_dpia_report	Risk register linking each risk to its measures, and the DPIA action plan
data_flow_review	Compliance review of every data flow: legal basis, special data, transfers, DPIA
cookie_consent_fix_plan	Every cookie consent gap with the fix and its legal source
iso27001_remediation_plan	Every ISO 27001 gap with an action, Annex A control and roadmap
vendor_due_diligence_plan	Vendor gaps with the evidence to request, and the contract clauses to include
maturity_improvement_plan	Capabilities below level 3 or 4 with the next action and references
cyber_risk_action_plan	Every cyber risk gap with an action, CSF and NIS2 references and roadmap
mcp_tools_report	Every tool list or Agent Card flag with an action and priority, a comparison with the approved version, an Audit Kit inventory row

Set it up

Menus differ between plans and app versions; if a step looks different, look for "connectors", "integrations" or "MCP servers" in your assistant's settings.

Claude (web and desktop)

Open Settings → Connectors and choose Add custom connector.
Name it ClevSec and paste the server address above. No sign-in is needed.
In a new chat, open the tools menu under the message box and switch ClevSec on.

Claude Code

claude mcp add --transport http clevsec https://mcp.clevsec.one/mcp

ChatGPT

Where your plan allows custom connectors, turn on developer mode in the connector settings, create a connector with the server address above, and select it in a chat.

Cursor

Add to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for all projects:

{
  "mcpServers": {
    "clevsec": { "url": "https://mcp.clevsec.one/mcp" }
  }
}

VS Code

Add to .vscode/mcp.json:

{
  "servers": {
    "clevsec": { "type": "http", "url": "https://mcp.clevsec.one/mcp" }
  }
}

Other clients

Any client that supports remote MCP servers over Streamable HTTP works. The server speaks the 2026-07-28 protocol and accepts stateless requests from clients on the 2025 versions.

Questions to try

Does NIS2 apply to a 120-person transport company?
Our payment system was down for 3 hours and 15% of clients were affected. Is this a major incident under DORA?
A laptop with unencrypted customer data was stolen. Do we have to notify anyone under the GDPR?
What must our privacy notice contain if we buy contact data from a data broker?
We found an actively exploited vulnerability in our router firmware. What must we report under the Cyber Resilience Act?

If your assistant searches the web instead, ask it to "use the ClevSec tool".

How it works

Deterministic: the tools are rules, not a language model. The same question gives the same answer, from the same code as our website tools.
Sourced: every answer lists its legal sources, the date we last checked them, and a link to the matching guide. The underlying rules are also available as open data.
Private: the tools ask for facts about an organisation or incident, not personal data. We do not store requests; our logs record only which tool was called. See the privacy policy and our Trust Center.
Fair use: up to 300 calls per minute per IP address. The free tools have no daily limit.

Use ClevSec from Your AI Assistant