io.tooloracle/ampel

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

AmpelOracle — 50-tool compliance traffic-light: Go/Caution/Stop signals for ESG, MiCA, AML.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "ampel": {
      "url": "https://tooloracle.io/ampel/mcp/",
      "transport": "streamable-http"
    }
  }
}

Measured tools (50)

• readiness_check

  Full DORA readiness score + Ampel per article. Returns GREEN/YELLOW/RED/GREY for all 26 articles, score 0-100, days until deadline.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• article_status

  Detailed Ampel for a specific DORA article. Each check with GREEN/YELLOW/RED conditions and evidence.

  Parameters:

  • article — string — e.g. Art. 28
  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• gap_report

  DORA compliance gaps. RED/GREY/YELLOW items with priority and required actions.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• evidence_summary

  All evidence artefacts for an entity with hashes and expiry dates.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• collect_art10

  Collect live Art. 10 evidence from NVD, CISA KEV, CERT-Bund. Auto-assesses.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• entity_list

  List all registered regulated entities.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_entity

  Register a new regulated entity.

  Parameters:

  • lei — string
  • name — string — Entity name
  • entity_type — string — Type
  • jurisdiction — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• audit_trail

  Chain-linked audit log with integrity check.

  Parameters:

  • limit — integer — Max entries
  • entity_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• generate_report

  Generate data-driven DORA Ampel PDF report. Score, gap analysis, provider register, audit trail integrity.

  Parameters:

  • format — string — json (meta) or pdf (download)
  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• freshness_check

  Run freshness watchdog. Expires stale evidence, downgrades GREEN->YELLOW->GREY if evidence too old.

  Parameters:

  • entity_id — string — Entity ID (optional, checks all)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bridge_report

  Bridge gap analysis: classifies gaps by DATA/EVIDENCE/POLICY/WORKFLOW with closure path, owner, effort level.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• register_provider

  Register an ICT third-party provider for DORA Art. 28 Register of Information. Stores provider data and creates evidence.

  Parameters:

  • lei — string — Legal Entity Identifier
  • services — string — Services provided
  • entity_id — string
  • criticality — string — critical, important, standard
  • contract_end — string
  • headquarters — string — Country e.g. Luxembourg, Germany
  • data_location — string — Where data is stored e.g. EU (Frankfurt)
  • provider_name — string — Provider name e.g. Amazon Web Services EMEA SARL
  • provider_type — string — cloud_infrastructure, saas_application, core_banking, cybersecurity, etc.
  • certifications — string
  • contract_start — string
  • annual_cost_eur — number
  • substitutability — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_contract

  Check DORA Art. 30 contract clauses for a provider. Returns PASS/WARN/BLOCK with missing clauses and bridge classification.

  Parameters:

  • is_cif — boolean — Is this a CIF (Critical/Important Function) provider?
  • entity_id — string
  • cif_clauses — array — CIF clauses if applicable
  • provider_id — string — Provider ID
  • exit_strategy — boolean — Exit strategy documented?
  • standard_clauses — array — Present standard clauses: service_description, data_location, data_protection, service_availability_sla, incident_notification, audit_right, termination_notice, cooperation_with_authorities

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• assess_all

  Re-run full assessment for an entity. Recomputes Ampel statuses from all available evidence.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• onboard_entity

  Full entity onboarding: creates initial RED assessments for all 39 checks, collects auto-evidence from live sources, re-assesses, and returns readiness score.

  Parameters:

  • entity_id — string — Entity ID to onboard

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bridge_resolve

  Start bridge resolution workflow. Generates templates (Risk Acceptance, Contract Renegotiation, Concentration Policy, Exit Strategy), tracks approval process. Call bridge_approve to sign off.

  Parameters:

  • check_id — string — Check to resolve: art30_c1, art30_c2, art30_c3, art8_c3, art31_c1
  • entity_id — string — Entity ID (optional)
  • expiry_days — integer — Days until resolution expires (default 30)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bridge_approve

  Approve or reject a bridge resolution. On approval: creates signed evidence, upgrades Ampel to GREEN, logs to audit chain.

  Parameters:

  • reject — boolean — Set true to reject instead of approve
  • approved_by — string — Name + role of approver (e.g. Dr. Mueller, CISO)
  • resolution_id — string — Resolution ID from bridge_resolve
  • rejection_reason — string — Reason for rejection (if rejecting)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bridge_status

  Check status of all bridge resolution workflows for an entity. Shows open, pending, closed, rejected.

  Parameters:

  • entity_id — string — Entity ID (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• reg_watchdog

  AI Regulatory Watchdog: scrapes EBA/ESMA/BaFin/CERT-Bund for DORA updates. Returns alerts with affected articles and severity. Run daily via cron or on-demand.

  Parameters:

  • days_back — integer — Check items from last N days (default: 7)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• azure_ad_check

  Live Azure AD integration: MFA registration %, risky users, conditional access policies. DORA Art. 9 evidence. Requires Azure AD config in integrations_config.json.

  Parameters:

  • force_refresh — boolean — Force fresh API call (default true)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• servicenow_sync

  ServiceNow incident + change management sync. DORA Art. 17/21 evidence. Returns 30-day incident stats, classification, resolution rates.

  Parameters:

  • days_back — integer — Days to look back (default 30)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• llm_clause_check

  LLM-based DORA Art. 30 contract analysis. Paste contract text, get clause-by-clause PRESENT/PARTIAL/MISSING for all 15 mandatory clauses. Uses Claude API.

  Parameters:

  • contract_text — string — Contract text (plain text from PDF). Paste key sections.
  • provider_name — string — Provider name e.g. Salesforce

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cross_oracle_assess

  Enterprise cross-oracle assessment. Runs 18 checks across CyberShield (NIS2/ISO 27001), SupplyChainOracle (LkSG/CSRD), HealthGuard (MDR/GDPR), CFOCoPilot (XRechnung), TaxOracle (DAC6), LegalTechOracle (DORA contracts). Auto-stores evidence and updates Ampel status.

  Parameters:

  • checks — string — Comma-separated check IDs or omit for all
  • entity_id — string — Entity to assess

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• health_check

  Server + DB status.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• ping

  Quick connectivity test.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bus_status

  Oracle Event Bus status: events, cross-refs, connected oracles.

  Parameters:

  • entity_id — string — Entity ID for cross-refs

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• escalation_status

  Get findings, SLA breaches, escalation status per entity.

  Parameters:

  • entity_id — string — Entity ID (empty=all)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• run_escalation

  Trigger escalation engine: auto-create findings, check SLA, escalate.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• whatif_provider

  Simulate provider failure: which articles/checks are affected, score impact, risk level.

  Parameters:

  • entity_id — string — Entity ID
  • provider_name — string — Provider name (e.g. AWS, Finastra)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• whatif_stale

  Simulate stale evidence: what happens if a check stays stale for N days.

  Parameters:

  • days — integer — Days stale (default 30)
  • check_id — string — Check ID
  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• board_summary

  Executive board summary: overall score, top 5 risks, overdue findings, SLA breaches, concentration risk, evidence health, owner workload. Designed for management/board reporting.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• update_finding

  Update finding lifecycle: claim, set remediation plan, request re-test, close, or accept risk. Status flow: open -> in_progress -> retest_pending -> closed | risk_accepted.

  Parameters:

  • actor — string — Who is performing this action
  • owner — string — New owner (for claim)
  • action — string — claim | plan | request_retest | close | accept_risk
  • reason — string — Close reason (for close)
  • finding_id — string — Finding ID
  • accepted_by — string — Name (for accept_risk)
  • expiry_days — integer — Risk acceptance expiry days (default 90)
  • remediation_plan — string — Remediation plan text (for plan)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• retest_finding

  Re-test a finding: collect fresh evidence, reassess check, auto-close if GREEN. Full closed-loop.

  Parameters:

  • finding_id — string — Finding ID to re-test

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• score_trend

  Score trend over time: weekly deltas, trajectory, peer benchmark. Shows improvement or decline.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• dependency_graph

  Full provider dependency graph: providers, systems, checks, blast radius, SPOF detection.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• incident_flow

  DORA incident lifecycle: log, classify, notify (BaFin), close. Each step creates signed evidence.

  Parameters:

  • title — string
  • action — string — log | classify | notify | close
  • severity — string
  • entity_id — string — Entity ID
  • root_cause — string
  • description — string
  • incident_id — string
  • report_type — string
  • classification — string
  • lessons_learned — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• evidence_pack

  Export evidence pack for article/check/entity. Pruefer-ready: evidence, assessments, findings, audit trail, signatures.

  Parameters:

  • article — string — DORA article e.g. Art. 10
  • check_id — string — Specific check ID
  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• provider_country_risk

  Enrich provider dependencies with OECD economic risk: GDP, unemployment, CLI per provider country. DORA Art. 28-31 relevant.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• contract_upload

  Upload contract text for DORA Art. 30 analysis. Creates document record with SHA-256 hash, version tracking, audit trail.

  Parameters:

  • entity_id — string — Entity ID
  • file_name — string — Original file name
  • contract_text — string — Contract text (extracted from PDF)
  • document_type — string — ict_outsourcing_agreement | dpa | sla | master_service_agreement
  • provider_name — string — Provider name

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• contract_analyze

  Analyze contract against 15 DORA Art. 30 mandatory clauses. Returns compliance status per clause with confidence score, extracted text, gap reasoning, suggested fix.

  Parameters:

  • document_id — string — Document ID from contract_upload

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• contract_status

  Overview of all analyzed contracts per entity. Shows clause gaps, review status, document versions.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cross_regulation_check

  Tag findings with cross-regulation impact (DORA + MiCA + AMLR). Shows which DORA findings also affect MiCA insider info or AMLR screening.

  Parameters:

  • entity_id — string — Entity ID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• regulation_impact

  Show cross-regulation impacts for a specific DORA article. Maps DORA → MiCA + AMLR.

  Parameters:

  • dora_article — string — DORA article ID (e.g. dora_art28)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bafin_report_draft

  Generate ITS 2024/1772 compliant BaFin incident report draft. All mandatory fields per DORA Art. 19/20. Preview mode — requires board approval.

  Parameters:

  • title — string
  • entity_id — string
  • root_cause — string
  • description — string
  • incident_id — string
  • remediation — string
  • report_type — string — initial | intermediate | final
  • classification — string — major | significant | minor
  • affected_clients — string
  • affected_services — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• bafin_approve_send

  Approve BaFin report for submission (4-eyes principle). Creates signed approval evidence.

  Parameters:

  • entity_id — string
  • report_id — string
  • approver_name — string
  • approver_role — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cve_asset_map

  Map CVE/vulnerability to internal ICT providers and systems. Auto-creates findings for critical matches. DORA Art. 10.

  Parameters:

  • cve_id — string — CVE identifier
  • vendor — string — Vendor/software name to check
  • entity_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• policy_draft

  Generate DORA policy/framework document draft for a specific article. 8 templates available (Art. 5,6,8,10,11,17,28,30). Uses entity data for customization.

  Parameters:

  • entity_id — string
  • dora_article — string — dora_art5|dora_art6|dora_art8|dora_art10|dora_art11|dora_art17|dora_art28|dora_art30

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_trial

  Create temporary trial entity (48h) for self-service DORA assessment. No login needed.

  Parameters:

  • providers — string — Comma-separated provider names: AWS,SWIFT,Finastra
  • entity_name — string — Institute name
  • entity_type — string — credit_institution|payment_institution|insurance_undertaking|asset_management|credit_institution_casp
  • jurisdiction — string — DE|AT|FR|etc

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• run_trial_assessment

  Run complete DORA+MiCA assessment for trial entity. Returns score, gaps, automation potential.

  Parameters:

  • trial_id — string
  • entity_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• generate_trial_report

  Generate watermarked trial report with score, gaps, and CTA.

  Parameters:

  • trial_id — string
  • entity_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.