Moltline RegClock

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Incident-reporting deadlines from the law: CRA, NIS2, DORA, GDPR, HIPAA, SEC 8-K. 6 of 9 tools free.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Moltline RegClock": {
      "url": "https://mcp.moltlinestudio.com/regclock",
      "transport": "streamable-http"
    }
  }
}

Measured tools (9)

• list_regimes read-only

  List the reporting regimes this server can compute, with citations. FREE. Typical input {} returns {"regimes": [{"id": "eu_nis2", "name": ..., "instrument": ..., "applies_from": ..., "event_types": [...]}, ...], "verified_on": "2026-09-06"}. Use when choosing the regime id and event_type for compute_deadlines or classify_event. Not for legal advice: it reports what the instruments say and when the entry was last checked. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• explain_rule read-only

  Quote the time limit, citation and required content for an obligation. FREE. Typical input {"regime": "eu_cra", "event_type": "severe_incident", "obligation": "final_report"} returns {"citation": "Art. 14(4)(c)", "rule": "within one month after ...", "required_content": [...]}. Leave obligation empty to get every obligation of the event type; leave event_type empty on single-event regimes. Use when a caller needs the rule's own words next to a computed date. Not for computing dates: use compute_deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • regime (required) — string — regime id from list_regimes (eu_cra, eu_nis2, eu_dora, eu_gdpr, uk_gdpr, us_hipaa, us_sec_8k).
  • event_type — string — event type within the regime (see list_regimes); optional when the regime has one.
  • obligation — string — obligation id (for example early_warning); empty for all.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• classify_event read-only

  Apply a regime's statutory criteria to yes/no facts and name the event type. FREE. Typical input {"regime": "eu_dora", "facts": {"critical_services_affected": true, "duration_or_downtime": true, "geographic_spread": true}} returns {"reportable": true, "event_type": "major_ict_incident", "reasoning": [...], "criteria": {...}}. Unanswered questions are listed under "missing" so the caller can go and find out. Use when deciding whether an incident triggers a regime at all. Not for judging severity in the abstract: it only applies the written criteria to the facts given. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "facts must be an object of question id -> answer"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • regime (required) — string — regime id from list_regimes.
  • facts (required) — object — answers keyed by the question ids returned for the regime (booleans; integers for counts).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• compute_deadlines read-only

  Compute every reporting deadline of one regime from the moment of awareness. FREE. Typical input {"regime": "eu_nis2", "event_type": "significant_incident", "awareness_at": "2026-09-14T09:30:00+02:00"} returns {"deadlines": [{"obligation": "early_warning", "due_at": "2026-09-15T09:30+02:00", "citation": "Art. 23(4)(a)", ...}, ...]}. Later clocks that run from an earlier submission are estimated from that report's due time until you pass the actual time in submitted. DORA needs classification_at and a country for the bank-holiday rule; the SEC needs materiality_determined_at; HIPAA takes discovery_date and flags.individuals_affected. Use when an incident has just been identified and the agent needs the instants. Not for several regimes at once: use compute_deadlines_multi. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "flags must be an object"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • regime (required) — string — regime id from list_regimes.
  • awareness_at (required) — string — when the entity became aware, ISO 8601 with a UTC offset.
  • flags — object — condition answers: high_risk, processor, ongoing, handled_at, individuals_affected, max_residents_of_one_state, business_associate.
  • subdiv — string — optional subdivision code for the holiday calendar (e.g. BY for Bavaria).
  • country — string — ISO 3166-1 alpha-2 code for the public-holiday calendar (DORA weekend rule; SEC uses US).
  • submitted — object — actual submission times of earlier reports, e.g. {"initial_notification": "..."}.
  • event_type — string — event type within the regime; optional when the regime has one.
  • entity_class — string — e.g. trust_service_provider (NIS2), credit_institution / central_counterparty / trading_venue_operator / nis2_essential_or_important (DORA), business_associate (HIPAA).
  • discovery_date — string — HIPAA - the date the breach is treated as discovered (defaults to awareness date).
  • classification_at — string — DORA - when the incident was classified as major.
  • measure_available_at — string — CRA - when a corrective or mitigating measure became available.
  • materiality_determined_at — string — SEC - when the incident was determined to be material.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• deadline_status read-only

  Mark each computed deadline open, due soon, overdue or submitted as of now. FREE. Typical input {"deadlines": <rows from compute_deadlines>, "now": "2026-09-15T08:00:00+02:00"} returns {"items": [{"obligation": "early_warning", "status": "due_soon", "hours_remaining": 1.5, ...}], "overdue": 0, "next_due": {...}}. Use when polling an incident timeline or deciding what to escalate next. Not for computing the deadlines themselves. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • deadlines (required) — array — rows from compute_deadlines / compute_deadlines_multi (each with obligation and due_at).
  • now (required) — string — the current instant, ISO 8601 with a UTC offset.
  • submitted — object — actual submission times keyed by obligation id (or "regime/obligation").

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• holiday_calendar read-only

  List the public holidays the engine uses for a country and year. FREE. Typical input {"country": "IE", "year": 2026} returns {"holidays": [{"date": "2026-01-01", "name": "New Year's Day"}, ...]}. Use when checking why a business-day or bank-holiday adjustment landed where it did, or to see whether a country/subdivision is supported. Not a legal register of bank holidays: it is the `holidays` package's public-holiday calendar, which is what compute_deadlines uses. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "country is required"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • country (required) — string — ISO 3166-1 alpha-2 code (DE, FR, IE, US, ...).
  • year (required) — integer — calendar year.
  • subdiv — string — optional subdivision code (state, province, region).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• compute_deadlines_multi read-only

  One merged timeline across several regimes for the same incident. PREMIUM (license). Typical input {"regimes": [{"regime": "eu_nis2"}, {"regime": "eu_gdpr"}, {"regime": "eu_dora", "entity_class": "credit_institution"}], "awareness_at": "2026-09-14T09:30:00+02:00", "country": "DE"} returns {"timeline": [rows sorted by due_at, each tagged with regime], "first_due": {...}, "per_regime": {...}}. Each entry may carry its own event_type and entity_class; the anchors and flags are shared. Use when one incident triggers several regimes and the agent needs a single ordered list. Not for one regime: compute_deadlines is free. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "regimes must be a non-empty list of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • regimes (required) — array — list of {"regime": id, "event_type"?: ..., "entity_class"?: ...} (1-10 entries).
  • awareness_at (required) — string — when the entity became aware, ISO 8601 with a UTC offset.
  • flags — object — condition answers shared by all regimes (see compute_deadlines).
  • subdiv — string — optional subdivision code for the holiday calendar.
  • country — string — ISO 3166-1 alpha-2 code for the public-holiday calendar.
  • submitted — object — actual submission times keyed by "regime/obligation" or obligation id.
  • entity_class — string — default entity class for entries that do not set their own.
  • discovery_date — string — HIPAA discovery date (defaults to the awareness date).
  • classification_at — string — DORA classification instant.
  • measure_available_at — string — CRA corrective-measure instant.
  • materiality_determined_at — string — SEC materiality determination instant.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• validate_report read-only

  Check a draft report against the statutory content list and its deadline. PREMIUM (license). Typical input {"regime": "eu_gdpr", "obligation": "supervisory_authority_notification", "report": {"nature": "...", "contact": "...", "consequences": "...", "measures": "..."}} returns {"checklist": [{"item": "...", "found": true, "evidence": [...]}, ...], "missing": [...], "coverage": 0.75, "timing": {...}}. The content check is a keyword heuristic over the report text, reported as such; the timing check compares submitted_at with due_at and, for GDPR, flags a late notification that gives no reasons for the delay. Use before a report is sent. Not a legal review, and it cannot judge quality, only presence. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • regime (required) — string — regime id from list_regimes.
  • obligation (required) — string — obligation id (for example incident_notification).
  • report (required) — object — the draft, as an object of section name -> text (any keys).
  • due_at — string — the computed due instant (from compute_deadlines), optional.
  • event_type — string — event type within the regime; optional when the regime has one.
  • submitted_at — string — when the report was or will be submitted, optional.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• timeline_export read-only

  Export computed deadlines as an iCalendar file and CSV rows. PREMIUM (license). Typical input {"deadlines": <rows from compute_deadlines or the timeline from compute_deadlines_multi>, "incident_ref": "INC-2026-041"} returns {"ics": "BEGIN:VCALENDAR...", "csv": "regime,obligation,...", "events": 4}. Each dated deadline becomes a VEVENT with the citation in the description and an alarm alarm_hours_before it; rows without a fixed time limit are listed in the CSV only. Use when the timeline needs to land in a calendar or a ticket. Not for computing deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Parameters:

  • deadlines (required) — array — rows from compute_deadlines / compute_deadlines_multi.
  • incident_ref — string — your incident reference, prefixed to every event summary.
  • calendar_name — string — X-WR-CALNAME for the calendar file.
  • alarm_hours_before — number — hours before each due instant to fire a VALARM (0 disables).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.