io.tooloracle/governanceoracle

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

GovernanceOracle - 10 governance tools: board packs, policies, attestations, evidence.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "governanceoracle": {
      "url": "https://tooloracle.io/governance/mcp/",
      "transport": "streamable-http"
    }
  }
}

Measured tools (11)

• register_finding

  Register an audit finding, risk, or control gap.

  Parameters:

  • title (required) — string
  • severity (required) — string
  • notes — string
  • owner — string
  • domain — string
  • source — string — audit, pentest, incident, self-assessment
  • status — string
  • due_date — string
  • finding_id — string
  • description — string
  • evidence_ref — string
  • related_article — string
  • remediation_plan — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_findings

  List findings with optional filters.

  Parameters:

  • owner — string
  • domain — string
  • status — string
  • severity — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• board_report

  Generate Management Body review pack — executive summary, open findings, risk posture, overdue items.

  Parameters:

  • period — string — Reporting period (e.g., 'Q1 2026')

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• framework_review

  ICT Risk Management Framework annual review — effectiveness assessment per DORA area.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• control_status

  Control effectiveness dashboard across all DORA control domains.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• exception_register

  View or add risk acceptances / exceptions with expiry tracking.

  Parameters:

  • add — boolean — Set true to add a new exception
  • title — string
  • finding_id — string
  • accepted_by — string
  • expiry_date — string
  • acceptance_date — string
  • risk_description — string
  • compensating_controls — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• action_tracker

  Track remediation actions with deadlines and ownership.

  Parameters:

  • add — boolean — Set true to add a new action
  • owner — string
  • title — string
  • due_date — string
  • priority — string
  • finding_id — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• kpi_dashboard

  ICT Risk KPIs — open findings, overdue rate, remediation rate, exception count.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• annual_review

  Annual framework review evidence bundle — checklist, stats, Art. 6(5) compliance.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• board_report_llm

  AI-powered board executive summary using local Gemma 4 LLM. Generates narrative summary from current findings in German or English.

  Parameters:

  • language — string — Language: de or en
  • additional_context — string — Extra context to include (deadlines, events)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• health_check

  Server status.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.