gateway

Ansvar Systems runs an MCP gateway that connects AI agents (Claude, Copilot, ChatGPT) to European and US laws, regulations, and standards — 49 live…

CommunityOnlineNo sign-inGlobalFreeCan modify data

What it can do

  • Search: Search requires at least one jurisdiction, framework, sector, or source; it does not auto-detect scope from the query. Find laws and regulations on a specific topic. TIER LIMITS: free tier tak
  • Diff: Compare two versions of a legal provision to see what changed. Use this when someone asks 'what changed in the latest DORA amendment', 'how did this article change between versions', or 'show me
  • Get Changes: Find observed rows from legislative change feeds in a jurisdiction or framework, or from an explicit source. Use this for questions such as 'what laws changed in Sweden this month' only w

What data it sees

Do you need an account

No: the server works without sign-in

Ansvar Systems runs an MCP gateway that connects AI agents (Claude, Copilot, ChatGPT) to European and US laws, regulations, and standards — 49 live jurisdictions with paragraph-level citations to the official publisher. Compliance workflows built in: threat modeling, DPIA, NIS2/DORA/CRA gap analysis. EU-hosted, subscription tiers, free plan available.

Server tool list (29)

Raw names from tools/list. Only developers need these.

searchSearch requires at least one jurisdiction, framework, sector, or source; it does not auto-detect scope from the query. Find laws and regulations on a specific topic. TIER LIMITS: free tier takes ONE jurisdiction or ONE framework per call — no sectors=, no multi-source scope, and no fan-out to agency guidance, case law, or preparatory works — with 100 searches/day and 3 concurrent calls. Solo lifts those scope limits — several jurisdictions, frameworks, and sources in one call — at a higher daily budget; the evidence layer stays premium+. Paid tiers carry high daily abuse ceilings (premium 5,000/seat; team 50,000 and company 500,000 pooled per organisation) sized well above legitimate use. Premium+ unlocks multi-jurisdiction server-side fan-out to agency-guidance, case-law, and preparatory-works MCPs alongside primary legislation — all returned in one `search` response; there is no separate `search_case_law` or `search_preparatory_works` tool to call. (For agency guidance only, the standalone `search_guidance` tool is also available if you want guidance results without primary-law fan-out.) Call get_my_capabilities to inspect your tier and remaining quota before issuing large batches. Use this when someone asks 'what does the law say about X in country Y' or 'which regulations cover Z'. Examples: • 'GDPR data retention rules' → search(query='data retention', frameworks=['GDPR']) • 'Swedish consumer protection' → search(query='konsumentskydd', jurisdictions=['SE']) • Cross-cutting industry vertical → search(query='vehicle cybersecurity', sectors=['automotive']) reaches automotive-cyber MCPs (UN ECE WP.29) regardless of jurisdiction • Topic without a country → call list_coverage first; present jurisdictions to the user or ask which applies • License questions need explicit sources= (no jurisdiction): - Software / code / SPDX / REUSE / CRA / NOTICE templates → sources=['data-use-license'] - Dataset licences / government open-data terms (NLOD, Etalab, OGL, DL-DE, IODL, KOGL) / vendor TOS (Westlaw, LexisNexis, Bloomberg) / Crown Copyright / EU Database Directive / Creative Commons family → sources=['data-use-license'] Always pass at least one of jurisdictions (ISO-2 like 'SE'/'DE'), frameworks ('GDPR', 'NIS2'), sectors ('automotive', 'aviation', 'insurance', 'maritime'), or sources. `frameworks=` filters the source set to MCPs that declare framework coverage — the query string is still FTS-matched against each source's native corpus, with no automatic mapping from framework controls to jurisdiction transposition articles. For cross-framework control mapping (e.g. ISO 27001 ↔ SOC 2 ↔ NIST 800-53), pass `frameworks=['ISO_27001','SOC_2',...]` — server-side fan-out includes Security Controls MCP. `sectors=` reaches industry-vertical MCPs that span multiple jurisdictions (UN ECE / EASA / IAIS regimes). jurisdictions= combined with sectors= is an INTERSECTION — only the sector's MCPs within those jurisdictions; an empty intersection returns an explicit error naming the jurisdictions that do carry the sector; sectors= alone stays cross-jurisdictional. Search the target language natively (e.g., SE: konsumentskydd, DE: Datenschutz, FR: protection des consommateurs). QUERY SHAPE: queries are keyword-matched (FTS5, implicit AND — every term must occur in the SAME provision). Pass one or two canonical concept terms per call; never a multi-concept compound. A compound such as 'incident reporting deadline personal data breach' returns 0 even when each concept on its own returns hits — so ask one concept per call and combine the answers yourself. Two terms describing ONE concept ('personal data') are fine; alternatives can be joined with OR (e.g. 'spoofing OR tampering'). STRICT MISS: when a search completes and no result matched your terms strictly, the response carries meta.outcome = 'NO_STRICT_MATCH' plus meta.recommended_action, meta.recommended_scopes, and meta.broadening_available — read those fields instead of the prose. On recommended_action = 'RETRY_ONE_CONCEPT_PER_CALL', re-issue the search with ONE concept per call. Where meta.broadening_available is true, relaxed matches exist and are withheld: pass allow_broadening=true to receive them, each stamped match_mode='broadened'. meta.recommended_scopes names scope ids that were not searched. If 0 results, tell the user; do not answer from training data. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference column MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.
diffCompare two versions of a legal provision to see what changed. Use this when someone asks 'what changed in the latest DORA amendment', 'how did this article change between versions', or 'show me the differences in GDPR Article 17 after the update'. Returns a structured diff with added, removed, and modified text. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference column MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.
get_changesFind observed rows from legislative change feeds in a jurisdiction or framework, or from an explicit source. Use this for questions such as 'what laws changed in Sweden this month' only when the requested scope is listed as amendment-capable. If since is omitted, the gateway defaults to the last 90 days. Coverage is per corpus. The EU Regulations source is baseline-only during the current interim: it is excluded from amendment-capable dispatch, and a framework it owns is advertised only if another reachable feed supports that framework. A successful empty response is not evidence that no amendments occurred. On a capability miss, the response names supported source, framework, and jurisdiction scopes — or, when no corpus advertises change feeds at all, says so explicitly with supported_scopes empty on every axis. Every dispatched response reports whether baseline rows were actually withheld and whether the producer supplied typed event metadata. Legacy rows without typed event metadata remain visible with event_kind unknown. Use diff for a known provision. Boundary: this tool reports amendments observed in SERVED corpus text; for newly published official acts and regulator announcements (what is new, not what changed in a text we serve), use search_regulatory_updates. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference column MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.
get_provisionLook up the exact text of a specific legal provision or standards-catalog control. Three addressing forms: (1) jurisdiction + law + article — use this when someone asks 'show me Article 5 of GDPR', 'what does Section 12 of the Swedish Work Environment Act say', or 'read me the text of DORA Article 11'; (2) canonical_ref — the exact ref a `search` row's `citation.lookup` hint advertises (e.g. get_provision(canonical_ref='loi-2018-07-30:art-64', jurisdiction='BE')): the gateway decomposes it and resolves the same way. Pass jurisdiction alongside canonical_ref when the ref does not embed one (relayed hints already include it). (3) law as a bare corpus/source id + article as the native control/entity id, NO jurisdiction — for non-jurisdictional standards catalogs (e.g. get_provision(law='nist-800-53', article='AC-5') for NIST SP 800-53, and the same shape for nist-csf-2, nist-800-82r3, nist-ai-rmf, nist-ssdf-800-218): a `search` row's `citation.lookup` hint for these corpora already advertises this exact shape — replay it verbatim. Returns the full provision text with citation metadata. A member-state jurisdiction plus an EU framework article that has a verified national transposition returns the NATIONAL transposing provision, with `meta.transposition` naming the swap; pass jurisdiction='EU' for the framework text itself. Where no such mapping applies, the same field may instead carry a typed disclosure describing Ansvar's verified coverage for that pair. When a national transposition IS served, the CELEX and instrument name that response reports are themselves valid `law` input in that jurisdiction — replay either. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference column MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.
validate_citationVerify whether a legal citation is accurate and still in force. Use this when someone asks 'is this citation correct', 'has this law been amended', or 'check whether Article 28 GDPR still says this'. Returns validation status with the current text if the provision has changed. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference column MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.
list_coverageShow which countries, frameworks, and legal domains are available. Use this BEFORE calling `search` when the user's topic doesn't name a jurisdiction (e.g., 'what does the law say about consumer protection'); then present the returned jurisdictions to the user or ask which applies. Examples: • 'Which countries do you cover?' → list_coverage() • 'Do you have German law?' → list_coverage(jurisdiction='DE') • 'What jurisdictions for NIS2?' → list_coverage(domain='cybersecurity') • 'Which countries have drone law?' → list_coverage(domain='aviation') (also accepts 'drone' / 'uas') Returns a `jurisdictions` array (each with `code`, `name`, `region`, `laws`, `provisions`, `domains`) plus framework and source listings. NOTE: `laws`/`provisions` are WHOLE-JURISDICTION corpus totals — the response's `count_scope` is `whole_jurisdiction`. Under a `domain` filter the jurisdiction list is narrowed to that domain but the counts are NOT domain-scoped; do not report them as a per-domain count. The domain-specific signal is the (domain-filtered) `sources`/`frameworks`.
get_my_capabilitiesTier, capabilities, limits, and live usage for the calling identity. Use this to decide what tools and fan-out paths are available before calling them, or to check remaining quota before issuing more requests — lower-tier agents can avoid wasted retries and decide whether to upgrade mid-conversation rather than discover limits by hitting walls. Visible to all tiers; takes no arguments. Returns a JSON document with: tier (free/solo/premium/team/company), capabilities (workflows, audit_ledger, include_premium_fanout — bool flags from ADR-026 §2 and ADR-032 §1), limits (max_concurrent_jobs, daily_quota — map tool→limit from ADR-028 §4, listing only tools your tier, scopes, and actor policy admit), usage_today (active_concurrent_calls, remaining_quota — map tool→remaining, both read live from the per-worker counters; team/company budgets pool per organisation, so seats of one org see a shared remaining number), upgrade_url (empty for company tier, otherwise the marketing page that explains the next tier up), and service_notices — subsystems currently in a known degraded state, each naming the exact affected tools/add-ons and the reason those tools return, so an advertised capability that is temporarily down is never a surprise (empty list when everything is healthy). Counters reset at UTC midnight; per-worker semantics mean an N-worker gateway has roughly N× the per-worker limits in aggregate.
describe_capabilitiesDiscover what Ansvar can do for your agent. Default (detail='summary') is a compact orientation view: one-line about, your tier summary, counts, a per-category index (id, name, available_to_caller, min_tier, entry_hint, tools/workflows counts, caveats for gated families), meta tool names, next_steps, the paid add-ons directory, and a sources count with a drill-down pointer. detail='full' returns the complete catalog (large — over 100k chars): category prose, the intent-keyed `common_use_cases` map, `anti_patterns`, guidance, the tour, and the full sources directory. section='sources' | 'addons' | 'tour' | <category id> returns that one section alone; an unknown section is an error listing the valid ids. section='sources' honors detail: the default 'summary' returns a compact directory (per-source id, name, aliases, premium, availability + a one-line coverage summary), while detail='full' returns every source's full coverage prose and example queries. detail is validated before section: an invalid detail is an error even when section= is passed. Every view is tier-aware: `available_to_caller` flags and caveat text reflect the caller, and gated families are shown with caveats, never silently omitted. The workflow lists are reconciled at read time against a TTL-cached snapshot of the live workflow registry (background-refreshed, 15 min): `workflow_types_index` carries the snapshot status (live / stale / unavailable) and `fetched_at`, plus registry types the curated catalog does not list yet; `catalog_drift` lists catalog ids the registry no longer serves (dropped from the payload). `service_notices` names subsystems in a known degraded state and the exact tools affected; a category's `tool_status` marks an advertised tool that currently dispatches on zero scopes fleet-wide (e.g. get_changes during the baseline-only interim), with the same reason_code the tool itself returns. Companion to get_my_capabilities (live tier / quota only). Backed by this repo's data/capabilities-catalog.yml (mirrored for documentation as infrastructure/gateway/capabilities-catalog.yml in arch-docs).
start_workflowBegin a structured workflow selected from the live workflow registry. The registry covers threat and privacy modeling; enterprise, automotive, robot, rail, OT and UAS risk/TARA; DPIA and FRIA; regulatory, medical-device, drone and machinery gap analysis; tender review and audit; document review; SORA authorisation; vulnerability prioritisation; and deferral dossiers. Call list_workflow_types first: it is the authoritative source of exact ids, deliverables, required slots, variants, and availability for this caller. When a fresh registry snapshot is available, this tool's workflow_type input schema carries a caller-authorized enum; otherwise it remains a string rather than silently falling back to a stale catalog. The workflow engine guides the process step by step with quality gates. Each step's questions_for_user is advisory — answerable from context or uploaded documents; only steps returning requires_user_input=true carry the server-enforced human-input gate. Which types you can start is tier-fenced: free and solo include seven types (1 and 2 runs a month) — threat_model, gap_analysis with its gap_analysis_nis2, gap_analysis_dora, gap_analysis_cra and gap_analysis_ai_act variants, and dpia, each reported as JSON or as a watermarked html or pdf — at those tiers the framework argument accepts only nis2, dora, cra or eu_ai_act, and the base gap_analysis needs one of them; Premium adds the rest of the interview-grounded catalog — LINDDUN, the TARA families, FRIA and the jurisdictional DPIA and gap variants, SORA, the drone and OT types, machinery conformity, and enterprise risk — with 5 runs a month; document review, the tender family and adversary tabletop require Team or Company. A start SPENDS a run from the monthly allowance, and on free and solo a cancel does not hand an unused one back — name the workflow_type you intend to the user and get their OK before calling this, and check get_my_capabilities for what is left.
resume_workflowContinue a compliance workflow that was paused or interrupted. Use this when someone says 'let's continue the gap analysis', 'pick up where we left off on the threat model', or 'resume my DPIA'. Requires the workflow_id from the original start_workflow call.
list_workflowsList your organisation's workflows (id, type, status, current step, last update). Filter with status='active', 'completed', or 'cancelled'. Results are paginated with limit (default 20, max 100) and offset; follow next_offset until null. Use it to recover a lost workflow_id or review past assessments.
cancel_workflowCancel an active workflow by id. Cancelled workflows cannot be resumed and are excluded from resume_workflow's active listing; their record stays visible in list_workflows. Idempotent — cancelling an already-cancelled workflow returns the same result.
get_current_stepCheck which step a compliance workflow is currently on and what input is needed next. Use this when someone asks 'where are we in the gap analysis', 'what's the next step', or 'what do I need to provide now'. Returns the current step description and expected input format. questions_for_user is advisory — answerable from context or uploaded documents; requires_user_input=true is the server-enforced human-input gate, and the step then lists user_provided_fields that must be filled before calling submit_response.
submit_responseProvide an answer to the current step in a compliance workflow. Use this when someone provides information requested by the workflow, such as 'our system processes health data' or 'we use AES-256 encryption'. The workflow engine validates the response and advances to the next step. Pass user_acknowledged=true only after the user has supplied the fields listed in user_provided_fields. evidence_references accepts document UUIDs, doc:// segment URIs, or regulatory URLs. For an unattended gate, pass approved_by='auto' and leave user_acknowledged=false so the report does not misrepresent automation as human review. approved_by accepts only 'auto'; human review is asserted via user_acknowledged, never by naming an approver.
get_progressSee how far along a compliance workflow is and which steps remain. Use this when someone asks 'how much of the gap analysis is done', 'what percentage is complete', or 'how many steps are left'. Returns completed and remaining steps with a progress percentage and quality score.
get_workflow_threatsReview the threats identified during a threat-modeling workflow. Use this when someone asks 'what threats were found', 'show me the risk assessment results', or 'list the identified vulnerabilities'. Returns threats with severity ratings and recommended mitigations from completed STRIDE analysis steps.
generate_reportProduce the final compliance report from a completed workflow. Use this when someone says 'generate the gap analysis report', 'I need the DPIA report as a document', or 'create the threat model output'. Refuses until every quality gate passes, returning the failing check and a hint. Returns a structured report with findings, citations, and recommendations. Pass format html, pdf, docx, or all to additionally receive branded rendered artifacts as short-lived download URLs in a sibling render key; render failures attach render_error and never drop the report JSON. Rendering is served by the document plane and starts at the team tier; on free and solo an included run also returns html or pdf carrying an Ansvar watermark. Every other tier receives the report as JSON, and a format the caller's tier does not serve is refused explicitly rather than quietly downgraded.
list_workflow_typesFind the authoritative live structured-workflow registry. Call this before start_workflow instead of guessing an id from examples or a static catalog. It covers every deployed workflow family, including risk/TARA, DPIA/FRIA, regulatory and medical-device gap analysis, procurement, document review, drone/OT workflows, and vulnerability decisions. Each entry carries workflow_type, base_type, display_name, description, produces (the final deliverable), required_slots, overridable_configurable, legal-review state, plus gateway-added minimum_tier and available_to_caller fields. Every tier sees the full directory; which rows are marked available depends on the caller — free and solo the seven included rows (threat_model, gap_analysis with its NIS2, DORA, CRA and AI Act variants, dpia), Premium the interview-grounded rows (adding LINDDUN, TARA, FRIA, the jurisdictional DPIA and gap variants, SORA, drone/OT, machinery conformity, enterprise risk), Team and Company every live row. A row locked by TIER carries tier_caveat: which tier runs it, what that tier adds, and the upgrade URL — so a tier-locked row is never a bare false. Discovery service failures and malformed responses fail explicitly; no static list is returned as if it were live.
create_dfdValidate a DFD artifact and render it as styled Mermaid. Returns {mermaid, validation_errors, structural_warnings}. Use after the DFD specialist (/threat-modeler-dfd) has finished extraction so the graph integrity (valid node types, declared trust_zones, reachable edge endpoints, recognised regulatory tokens) is checked before the artifact is submitted via submit_response on scoping.component_identification. artifact = {nodes, edges, trust_zones, assets}, each a list. node: {id, type, trust_zone, name?} where type is one of process|data_store|external_entity|actor and trust_zone references a trust_zones[].id. edge: {src_node, dst_node, id?, protocol?, authentication?, encrypted?, crosses_boundary?} where src_node/dst_node reference node ids (from/to accepted as aliases). trust_zone: {id, name?}. asset: {owner_node, id?, regulatory_relevance?} where owner_node references a node id and regulatory_relevance tokens are one of GDPR|PCI_DSS|DORA|NIS2|EU_AI_Act|HIPAA|ePrivacy|EBA|EIOPA. Bad input returns validation_errors with mermaid=null; it never raises.
recommend_subagentsPlan the parallel sub-analyses for a threat-modeling phase. Given the current phase of a threat_model workflow (its id comes from get_current_step) and your workflow context, returns the recommended breakdown: which analysis prompts to run, with what arguments, which can run in parallel, and an inline fallback for MCP clients that cannot invoke prompts. phase_id is one of: phase_0b_scope_check, phase_1_scope_and_dfd, phase_2_stride_enumeration, phase_2b_domain_challenge, phase_3_scoring, phase_3b_threat_enrichment, phase_5_mitigation, gap_assess_controls. Optional — the workflow works without it; use it to speed up large systems by fanning phases out to subagents.
search_cveSearch CVEs by keyword, severity, score range, and filters. Returns matching CVE records with CVSS scores, KEV status, and EPSS data. Use get_cve_details for full information on a specific CVE. Supports full-text search on descriptions.
get_cve_detailsGet complete details for a specific CVE including CVSS scores, references, CPE mappings, KEV status, EPSS score, exploit references, and any CISA ICS/OT advisories (ICSA/ICSMA/ICSV) referencing it with their affected industrial products — use this to enrich an OT/ICS or robot-cell TARA with live advisory context.
check_kev_statusCheck if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Returns KEV details including required remediation actions and due dates.
get_epss_scoreGet the EPSS (Exploit Prediction Scoring System) score for a CVE. Returns the probability of exploitation in the next 30 days and percentile ranking.
search_by_productFind CVEs affecting a specific product and version. Useful for vulnerability assessment of software components.
get_exploitsGet public exploit code references for a CVE from Metasploit, ExploitDB, GitHub PoCs, and other sources.
batch_searchGet details for multiple CVEs in one query (max 100). Efficient for bulk vulnerability assessment.
get_data_freshnessCheck the freshness and sync status of all data sources. Returns last sync time, data age in hours, record counts, and health status (current/stale/critical) for each source: NVD, CISA KEV, EPSS, ExploitDB. Use this to verify data is up-to-date before making security assessments.
get_regulatory_intelligence_statusReport what this service actually monitors and how current each source is: the enrolled sources, their publisher, channel kind and jurisdictions, when each last synced successfully, its freshness state (current / stale / critical / unfetched / baseline-only), how many records it holds, and when its baseline backfill ran. Also reports the state of the signed licensing verdict that governs which sources may be fetched at all. Read this before concluding anything from an empty search: a source that is not enrolled, or whose state is critical, is not covered, and this tool says so plainly. `enrolled` means the current verdict clears the source AND its acquisition proof is verified. Example: "Using Ansvar, which regulatory sources are you monitoring and how fresh are they?"