com.moltlinestudio/regclock

Est-ce que com.moltlinestudio/regclock est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.moltlinestudio/regclock » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 9 outils

• classify_event≈ 394 tokens

  Apply a regime's statutory criteria to yes/no facts and name the event type. FREE. Typical input {"regime": "eu_dora", "facts": {"critical_services_affected": true, "duration_or_downtime": true, "geographic_spread": true}} returns {"reportable": true, "event_type": "major_ict_incident", "reasoning": [...], "criteria": {...}}. Unanswered questions are listed under "missing" so the caller can go and find out. Use when deciding whether an incident triggers a regime at all. Not for judging severity in the abstract: it only applies the written criteria to the facts given. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "facts must be an object of question id -> answer"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (2)

  Paramètres

  • facts · object · requis
    answers keyed by the question ids returned for the regime (booleans; integers for counts).
  • regime · string · requis
    regime id from list_regimes.

  Exemple d'appel

  {"name": "classify_event", "arguments": {"facts": {}, "regime": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• compute_deadlines≈ 837 tokens

  Compute every reporting deadline of one regime from the moment of awareness. FREE. Typical input {"regime": "eu_nis2", "event_type": "significant_incident", "awareness_at": "2026-09-14T09:30:00+02:00"} returns {"deadlines": [{"obligation": "early_warning", "due_at": "2026-09-15T09:30+02:00", "citation": "Art. 23(4)(a)", ...}, ...]}. Later clocks that run from an earlier submission are estimated from that report's due time until you pass the actual time in submitted. DORA needs classification_at and a country for the bank-holiday rule; the SEC needs materiality_determined_at; HIPAA takes discovery_date and flags.individuals_affected. Use when an incident has just been identified and the agent needs the instants. Not for several regimes at once: use compute_deadlines_multi. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "flags must be an object"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (12)

  Paramètres

  • flags · object · optionnel
    condition answers: high_risk, processor, ongoing, handled_at, individuals_affected, max_residents_of_one_state, business_associate.
  • regime · string · requis
    regime id from list_regimes.
  • subdiv · string · optionnel
    optional subdivision code for the holiday calendar (e.g. BY for Bavaria).
  • country · string · optionnel
    ISO 3166-1 alpha-2 code for the public-holiday calendar (DORA weekend rule; SEC uses US).
  • submitted · object · optionnel
    actual submission times of earlier reports, e.g. {"initial_notification": "..."}.
  • event_type · string · optionnel
    event type within the regime; optional when the regime has one.
  • awareness_at · string · requis
    when the entity became aware, ISO 8601 with a UTC offset.
  • entity_class · string · optionnel
    e.g. trust_service_provider (NIS2), credit_institution / central_counterparty / trading_venue_operator / nis2_essential_or_important (DORA), business_associate (HIPAA).
  • discovery_date · string · optionnel
    HIPAA - the date the breach is treated as discovered (defaults to awareness date).
  • classification_at · string · optionnel
    DORA - when the incident was classified as major.
  • measure_available_at · string · optionnel
    CRA - when a corrective or mitigating measure became available.
  • materiality_determined_at · string · optionnel
    SEC - when the incident was determined to be material.

  Exemple d'appel

  {"name": "compute_deadlines", "arguments": {"regime": "texte", "awareness_at": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• compute_deadlines_multi≈ 719 tokens

  One merged timeline across several regimes for the same incident. PREMIUM (license). Typical input {"regimes": [{"regime": "eu_nis2"}, {"regime": "eu_gdpr"}, {"regime": "eu_dora", "entity_class": "credit_institution"}], "awareness_at": "2026-09-14T09:30:00+02:00", "country": "DE"} returns {"timeline": [rows sorted by due_at, each tagged with regime], "first_due": {...}, "per_regime": {...}}. Each entry may carry its own event_type and entity_class; the anchors and flags are shared. Use when one incident triggers several regimes and the agent needs a single ordered list. Not for one regime: compute_deadlines is free. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "regimes must be a non-empty list of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (11)

  Paramètres

  • flags · object · optionnel
    condition answers shared by all regimes (see compute_deadlines).
  • subdiv · string · optionnel
    optional subdivision code for the holiday calendar.
  • country · string · optionnel
    ISO 3166-1 alpha-2 code for the public-holiday calendar.
  • regimes · array · requis
    list of {"regime": id, "event_type"?: ..., "entity_class"?: ...} (1-10 entries).
  • submitted · object · optionnel
    actual submission times keyed by "regime/obligation" or obligation id.
  • awareness_at · string · requis
    when the entity became aware, ISO 8601 with a UTC offset.
  • entity_class · string · optionnel
    default entity class for entries that do not set their own.
  • discovery_date · string · optionnel
    HIPAA discovery date (defaults to the awareness date).
  • classification_at · string · optionnel
    DORA classification instant.
  • measure_available_at · string · optionnel
    CRA corrective-measure instant.
  • materiality_determined_at · string · optionnel
    SEC materiality determination instant.

  Exemple d'appel

  {"name": "compute_deadlines_multi", "arguments": {"regimes": [], "awareness_at": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• deadline_status≈ 417 tokens

  Mark each computed deadline open, due soon, overdue or submitted as of now. FREE. Typical input {"deadlines": <rows from compute_deadlines>, "now": "2026-09-15T08:00:00+02:00"} returns {"items": [{"obligation": "early_warning", "status": "due_soon", "hours_remaining": 1.5, ...}], "overdue": 0, "next_due": {...}}. Use when polling an incident timeline or deciding what to escalate next. Not for computing the deadlines themselves. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (3)

  Paramètres

  • now · string · requis
    the current instant, ISO 8601 with a UTC offset.
  • deadlines · array · requis
    rows from compute_deadlines / compute_deadlines_multi (each with obligation and due_at).
  • submitted · object · optionnel
    actual submission times keyed by obligation id (or "regime/obligation").

  Exemple d'appel

  {"name": "deadline_status", "arguments": {"now": "texte", "deadlines": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• explain_rule≈ 421 tokens

  Quote the time limit, citation and required content for an obligation. FREE. Typical input {"regime": "eu_cra", "event_type": "severe_incident", "obligation": "final_report"} returns {"citation": "Art. 14(4)(c)", "rule": "within one month after ...", "required_content": [...]}. Leave obligation empty to get every obligation of the event type; leave event_type empty on single-event regimes. Use when a caller needs the rule's own words next to a computed date. Not for computing dates: use compute_deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (3)

  Paramètres

  • regime · string · requis
    regime id from list_regimes (eu_cra, eu_nis2, eu_dora, eu_gdpr, uk_gdpr, us_hipaa, us_sec_8k).
  • event_type · string · optionnel
    event type within the regime (see list_regimes); optional when the regime has one.
  • obligation · string · optionnel
    obligation id (for example early_warning); empty for all.

  Exemple d'appel

  {"name": "explain_rule", "arguments": {"regime": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• holiday_calendar≈ 375 tokens

  List the public holidays the engine uses for a country and year. FREE. Typical input {"country": "IE", "year": 2026} returns {"holidays": [{"date": "2026-01-01", "name": "New Year's Day"}, ...]}. Use when checking why a business-day or bank-holiday adjustment landed where it did, or to see whether a country/subdivision is supported. Not a legal register of bank holidays: it is the `holidays` package's public-holiday calendar, which is what compute_deadlines uses. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "country is required"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (3)

  Paramètres

  • year · integer · requis
    calendar year.
  • subdiv · string · optionnel
    optional subdivision code (state, province, region).
  • country · string · requis
    ISO 3166-1 alpha-2 code (DE, FR, IE, US, ...).

  Exemple d'appel

  {"name": "holiday_calendar", "arguments": {"year": 1, "country": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_regimes≈ 264 tokens

  List the reporting regimes this server can compute, with citations. FREE. Typical input {} returns {"regimes": [{"id": "eu_nis2", "name": ..., "instrument": ..., "applies_from": ..., "event_types": [...]}, ...], "verified_on": "2026-09-06"}. Use when choosing the regime id and event_type for compute_deadlines or classify_event. Not for legal advice: it reports what the instruments say and when the entry was last checked. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_regimes", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• timeline_export≈ 478 tokens

  Export computed deadlines as an iCalendar file and CSV rows. PREMIUM (license). Typical input {"deadlines": <rows from compute_deadlines or the timeline from compute_deadlines_multi>, "incident_ref": "INC-2026-041"} returns {"ics": "BEGIN:VCALENDAR...", "csv": "regime,obligation,...", "events": 4}. Each dated deadline becomes a VEVENT with the citation in the description and an alarm alarm_hours_before it; rows without a fixed time limit are listed in the CSV only. Use when the timeline needs to land in a calendar or a ticket. Not for computing deadlines. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "deadlines must be a non-empty list of rows from compute_deadlines"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (4)

  Paramètres

  • deadlines · array · requis
    rows from compute_deadlines / compute_deadlines_multi.
  • incident_ref · string · optionnel
    your incident reference, prefixed to every event summary.
  • calendar_name · string · optionnel
    X-WR-CALNAME for the calendar file.
  • alarm_hours_before · number · optionnel
    hours before each due instant to fire a VALARM (0 disables).

  Exemple d'appel

  {"name": "timeline_export", "arguments": {"deadlines": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• validate_report≈ 553 tokens

  Check a draft report against the statutory content list and its deadline. PREMIUM (license). Typical input {"regime": "eu_gdpr", "obligation": "supervisory_authority_notification", "report": {"nature": "...", "contact": "...", "consequences": "...", "measures": "..."}} returns {"checklist": [{"item": "...", "found": true, "evidence": [...]}, ...], "missing": [...], "coverage": 0.75, "timing": {...}}. The content check is a keyword heuristic over the report text, reported as such; the timing check compares submitted_at with due_at and, for GDPR, flags a late notification that gives no reasons for the delay. Use before a report is sent. Not a legal review, and it cannot judge quality, only presence. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "unknown obligation '<value>' for <value>/<value>; one of <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (6)

  Paramètres

  • due_at · string · optionnel
    the computed due instant (from compute_deadlines), optional.
  • regime · string · requis
    regime id from list_regimes.
  • report · object · requis
    the draft, as an object of section name -> text (any keys).
  • event_type · string · optionnel
    event type within the regime; optional when the regime has one.
  • obligation · string · requis
    obligation id (for example incident_notification).
  • submitted_at · string · optionnel
    when the report was or will be submitted, optional.

  Exemple d'appel

  {"name": "validate_report", "arguments": {"regime": "texte", "report": {}, "obligation": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.moltlinestudio.com/regclock