Indian Cyber Regulation Register (BitScore)

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Indian cyber regulation register and incident-reporting deadlines (India, US, EU), read at source.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Indian Cyber Regulation Register (BitScore)": {
      "url": "https://www.bitscore.in/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (9)

• search_instruments read-only

  Search every cyber and data-protection instrument binding Indian regulated entities (RBI, SEBI, IRDAI, IFSCA, CERT-In, MeitY/DPDP): reference number, issue date, status, who it binds and the deadlines it sets. Filter by free text, issuer or status. Returns summaries; use get_instrument for one entry in full.

  Parameters:

  • limit — integer — Maximum results, 1–50. Default 20.
  • query — string — Words to match against the name, reference number and who it binds, e.g. "outsourcing", "NBFC", "2024/113".
  • issuer — string — Only instruments from this issuer.
  • status — string — Only instruments with this status.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• get_instrument read-only

  Full register entry for one instrument by its id (from search_instruments): formal name, reference, issue date, status, who it binds, every dated deadline it sets, the regulator’s own URL and the date it was last re-read there.

  Parameters:

  • id (required) — string — Register id, e.g. "rbi-cyber-2026-nbfc" or "sebi-cscrf".

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• find_applicable_regulations read-only

  Given an Indian entity class, whether it is listed and whether it handles personal data, returns the cyber and data-protection instruments that bind it, why each applies, a caution where one is commonly misapplied, and its next dated deadline. RBI classes each map to their own 2026 Directions; RRBs and LABs have none, and the result says so.

  Parameters:

  • entity_class (required) — string — The entity’s class.
  • listed (required) — boolean — Listed on an Indian stock exchange (brings SEBI LODR disclosure).
  • handles_personal_data (required) — boolean — Processes digital personal data of individuals in India (brings DPDP).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• india_incident_reporting_deadlines read-only

  Every incident-reporting clock an Indian entity owes — CERT-In six hours, the sectoral regulator (RBI, SEBI, IRDAI, IFSCA), SEBI LODR, NCIIPC, DPDP — each with its trigger, recipient, channel and source clause. Give noticed_at to get wall-clock IST due times. Clocks run in parallel; none discharges another.

  Parameters:

  • sector (required) — string — Sectoral regulator, or "none".
  • listed (required) — boolean — Listed on an Indian stock exchange.
  • protected_system (required) — boolean — Operates a notified Protected System (brings NCIIPC).
  • personal_data (required) — boolean — The incident involves digital personal data.
  • ifsca_mii — boolean — IFSC market infrastructure institution (stock exchange, clearing corporation, depository).
  • rbi_class — string — Required when sector is "rbi".
  • nbfc_layer — string — For an NBFC: its layer under Scale-Based Regulation.
  • noticed_at — string — Optional. When the incident was noticed or brought to notice, ISO 8601 with offset, e.g. 2026-10-01T14:30:00+05:30.
  • ifsca_exempt — boolean — IFSCA RE inside either exemption tier of the 2025 Guidelines.
  • sebi_broker_or_dp — boolean — SEBI stock broker or depository participant (adds a six-hour leg to the exchanges/depositories).

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• us_eu_incident_reporting_deadlines read-only

  Incident-reporting clocks under SEC Form 8-K/6-K, NYDFS Part 500, the US bank 36-hour rule, HIPAA, the FTC Safeguards Rule, NIS2, DORA, GDPR and the EU Cyber Resilience Act, each from its own trigger. Give aware_at (and decided_at for materiality/classification clocks) for wall-clock due times.

  Parameters:

  • sec (required) — string — SEC status.
  • nydfs (required) — boolean — Regulated by the New York DFS (23 NYCRR 500).
  • us_bank (required) — boolean — A US banking organisation under the 36-hour computer-security incident rule.
  • bank_service_provider (required) — boolean — A bank service provider under the same rule.
  • hipaa (required) — string — HIPAA role.
  • ftc_safeguards (required) — boolean — A non-bank financial institution under the FTC Safeguards Rule.
  • nis2 (required) — boolean — An essential or important entity under NIS2.
  • dora (required) — string — DORA status.
  • gdpr (required) — string — GDPR role for the personal data involved.
  • cra_manufacturer (required) — boolean — A manufacturer of products with digital elements under the EU CRA.
  • aware_at — string — Optional. When the entity became aware, ISO 8601 with offset.
  • decided_at — string — Optional. When materiality/reportability/major classification was determined, ISO 8601 with offset.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• find_global_cyber_regulations read-only

  For an organisation operating across India, the US and the EU, lists the cyber and data-protection regimes that apply, may apply (check) or are pending, with why and a caution for each. All flags default to false and sizes/sectors to none.

  Parameters:

  • sec — string — SEC status.
  • size — string — Enterprise size.
  • hipaa — boolean — Covered entity or business associate under HIPAA.
  • nydfs — boolean — Regulated by the New York DFS.
  • us_bank — boolean — US banking organisation.
  • nis2_sector — string — NIS2 sector annex.
  • india_listed — boolean — Listed on an Indian stock exchange.
  • ftc_safeguards — boolean — Non-bank financial institution under the FTC Safeguards Rule.
  • cra_manufacturer — boolean — Manufacturer of products with digital elements sold in the EU.
  • eu_personal_data — boolean — Processes personal data of people in the EU.
  • india_operations — boolean — Operates in India.
  • us_personal_data — boolean — Holds personal data of US residents.
  • india_personal_data — boolean — Processes digital personal data of individuals in India.
  • dora_financial_entity — boolean — EU financial entity under DORA.
  • india_financial_regulated — boolean — Regulated by RBI, SEBI, IRDAI or IFSCA.
  • ict_provider_to_eu_finance — boolean — ICT third-party provider to EU financial entities.
  • us_critical_infrastructure — boolean — US critical-infrastructure sector.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• sebi_cscrf_category read-only

  Works out a SEBI regulated entity’s CSCRF category (MII, Qualified, Mid-size, Small-size, Self-certification or Exempt) from the current thresholds, and the obligations that category carries. Call with only entity_type to see which figures it needs. Boundary values the circulars leave uncategorised are reported as such, not guessed.

  Parameters:

  • entity_type (required) — string — The SEBI entity type.
  • auc — number — Figure for the "auc" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • aum — number — Figure for the "aum" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • corpus — number — Figure for the "corpus" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • folios — number — Figure for the "folios" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • registered_clients — number — Figure for the "registered-clients" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • collateral_with_ccs — number — Figure for the "collateral-with-ccs" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.
  • clientele_trading_volume — number — Figure for the "clientele-trading-volume" criterion (see entity_type's required figures). ₹ crore values in crore; counts as plain numbers.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• india_threat_scorecard read-only

  Aggregate counts of publicly observed cyber threat activity affecting Indian organisations, by industry vertical and category, for one edition (latest by default). Aggregate only: no organisation is named. A vertical the source did not cover is unmeasured, not zero.

  Parameters:

  • edition — string — Edition slug, YYYY-MM. Omit for the latest.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• cyber_weather_today read-only

  Today’s global cyber threat condition (Clear, Cloudy, Showers, Storm or Severe) from BitScore’s Cyber Weather, refreshed daily at 07:30 IST: points per instrument, CISA KEV additions, EPSS risers, outlook, patch calendar, outages and three actions. Each field names its source and licence. Indicative, not a measure of any organisation’s risk.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.