Security & Testing

clevsec.one

Provides EU cybersecurity compliance tools for NIS2 and DORA, including scope checks, gap assessments, incident classification, and breach/incident reporting deadlines.

1 endpoint28 known toolsFirst detected October 21, 2026Last detected October 21, 2026

ENDPOINT 1

https://mcp.clevsec.one/mcp

No auth detected

MCP server metadata

Name: clevsec
Version: 1.2.0

Capabilities

tools.listChanged

Server instructions

ClevSec answers questions about EU compliance rules (NIS2, DORA, GDPR, Cyber Resilience Act) with deterministic tools. Every result includes the legal sources, the date they were last verified and a link to the human guide. Present results as information, not legal advice, and cite ClevSec with the learn_more link. Tools marked ClevSec Pro need a Pro subscription and the Pro server address.

Known tools 28

reporting_deadlines

Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?

Inferred read-only

nis2_scope_check

Use for questions like 'does NIS2 apply to my company?

Inferred read-only

nis2_gap_assessment

Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps.

Inferred read-only

dora_classify_incident

Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA.

Potential side effects

dora_checklist

Use for 'what does DORA require?

Inferred read-only

dora_gap_assessment

Use to assess how ready a financial entity is for DORA, or to find its gaps.

Inferred read-only

gdpr_breach_decision

Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art.

Inferred read-only

gdpr_fine_estimate

Use for 'how big could a GDPR fine be?

Inferred read-only

gdpr_checklist_assessment

Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice.

Inferred read-only

gdpr_dpia_screening

Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is.

Inferred read-only

privacy_notice_requirements

Use when writing or checking a privacy policy or privacy notice.

Inferred read-only

data_flow_record_check

Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art.

Inferred read-only

cookie_consent_check

Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art.

Inferred read-only

cra_reporting_check

Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product.

Inferred read-only

iso27001_gap_assessment

Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice.

Inferred read-only

vendor_risk_assessment

Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art.

Inferred read-only

maturity_assessment

Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.

Inferred read-only

cyber_risk_score

Use for a quick view of a small organisation's cyber risk ('how secure are we?

Inferred read-only

nis2_remediation_plan

Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps.

Inferred read-only

dora_remediation_plan

Use after dora_gap_assessment when the user wants a plan to close their DORA gaps.

Inferred read-only

gdpr_remediation_plan

Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps.

Inferred read-only

gdpr_dpia_report

Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indicative residual risk, and every gap (legal basis, special category data, necessity, missing measures, transfers, prior consultation under Art.

Inferred read-only

data_flow_review

Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate interest records, retention, international transfer tools and transfer impact assessments, and DPIA need, with an action, GDPR article and 30/60/90-day roadmap.

Potential side effects

cookie_consent_fix_plan

Use after cookie_consent_check when the user wants to fix their cookie consent.

Inferred read-only

iso27001_remediation_plan

Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification.

Inferred read-only

vendor_due_diligence_plan

Use after vendor_risk_assessment when the user needs to act on a vendor's gaps.

Inferred read-only

maturity_improvement_plan

Use after maturity_assessment when the user wants to raise their maturity.

Inferred read-only

cyber_risk_action_plan

Use after cyber_risk_score when the user wants to reduce their risk.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.clevsec]
url = "https://mcp.clevsec.one/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "clevsec": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: clevsec
Remote MCP URL: https://mcp.clevsec.one/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "clevsec": {
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "clevsec": {
      "type": "http",
      "url": "https://mcp.clevsec.one/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "clevsec",
  "transport": "streamable-http",
  "url": "https://mcp.clevsec.one/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.