Loading…
EU financial regulatory compliance monitoring across DORA, MiCA, MiFID II, AML, and Solvency II.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Velvoite MCP server exposes 26 tools, focused primarily on general-purpose capabilities. Its published description reads: "EU financial regulatory compliance monitoring across DORA, MiCA, MiFID II, AML, and Solvency II". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates Velvoite F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Database tool takes a raw, unparameterised query". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Velvoite's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Velvoite to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.velvoite.eu/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Get an overview of the Velvoite regulatory corpus. Returns document counts by source, regulation family, entity type, urgency distribution, obligation summary, and date range. Call this FIRST to orien
Search the regulatory corpus using keyword / trigram matching. Uses PostgreSQL trigram similarity on document titles and summaries. Returns documents ranked by relevance with summaries and classificat
Browse regulatory documents with filters and pagination. Returns a paginated list of documents with summaries, tags, doc_purpose (regulation_text, enforcement, reference, irrelevant), and doc_jurisdic
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_regulations
A tool description tries to alter the model’s use of another tool.
gs. Prefer list_documents with filters (regulation, entity_type, source)RecommendationDescriptions must describe only their own tool.
tool: search_regulations
A database tool exposes a query/sql parameter that is a free-form string with no allow-list or parameterisation constraint — a raw-string injection surface. A tool exposing structured filters or an `enum` of named queries does not fire.
unconstrained query parameter "query"RecommendationExpose parameterised operations instead of a raw query string; never build queries from unvalidated model output.
tool: list_documents
A tool description tries to alter the model’s use of another tool.
days). Use search_regulations instead when you have specific keywords to searRecommendationDescriptions must describe only their own tool.
tool: get_document
A tool description tries to alter the model’s use of another tool.
ocument_id from search_regulations or list_documents results. Args: dRecommendationDescriptions must describe only their own tool.
tool: get_obligations
A tool description tries to alter the model’s use of another tool.
instead of raw obligations. page: Page number (default 1).RecommendationDescriptions must describe only their own tool.
tool: get_canonical_obligations
A tool description tries to alter the model’s use of another tool.
get_obligations when you want a clean, deduplicated view of what a reRecommendationDescriptions must describe only their own tool.
tool: get_obligation_summary
A tool description tries to alter the model’s use of another tool.
any's roles, or get_actor_roles to browse all available roles.RecommendationDescriptions must describe only their own tool.
tool: get_actor_roles
A tool description tries to alter the model’s use of another tool.
ations with get_obligations(actor_role=...). Returns roles grouped byRecommendationDescriptions must describe only their own tool.
tool: get_company_profile
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
termined by the API key. Returns: company_name: Company naRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_company_profile
A tool description tries to alter the model’s use of another tool.
bligations with get_obligations(actor_role=...). The profile is the baseliRecommendationDescriptions must describe only their own tool.
tool: get_enforcement_decisions
A tool description tries to alter the model’s use of another tool.
Combine with get_company_profile to find enforcement actions relevant to theRecommendationDescriptions must describe only their own tool.
tool: get_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "feedback_type"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_finnish_statute
A tool description tries to alter the model’s use of another tool.
e list. Use search_finnish_statutes to find the year/number for an unknown statute.RecommendationDescriptions must describe only their own tool.
tool: get_eurlex_document
A tool description tries to alter the model’s use of another tool.
PARQL). Use get_eu_regulation_article for known regulation codes (gdpr, dora, mica…).RecommendationDescriptions must describe only their own tool.
tool: get_kho_decision
A tool description tries to alter the model’s use of another tool.
24:52). Use search_kho_decisions(year) to browse all decisions for a given year.RecommendationDescriptions must describe only their own tool.
tool: search_kho_decisions
A tool description tries to alter the model’s use of another tool.
y. Then use get_kho_decision(year, number) to retrieve a specific decision.RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
actor roles) 2. get_stats — corpus size and coverage overview. Call firstRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_finnish_statute
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_finnish_statutes
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_finnish_company
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_finnish_companies
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_eu_regulation_text
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_cjeu_cases
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_eurlex_document
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_kho_decision
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_kho_decisions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get full details of a specific regulatory document by its ID. Returns the document metadata, AI summary, all classification tags, inline obligations (up to 50 with total count), and a link to the orig
Get regulatory obligations - specific requirements extracted from regulations. Each obligation includes the requirement text, applicable article reference, deadline, which entity types it applies to,
Get deduplicated canonical obligations with enforcement intelligence. Returns one obligation per unique legal requirement per actor role. Each includes compliance difficulty, guidance, and enforcement
Get top enforced canonical obligations. Returns obligations ranked by enforcement activity for risk prioritization. This is a focused view of canonical obligations filtered to only those with at least
Get upcoming regulatory deadlines for compliance calendar tracking. Returns obligations with deadlines in chronological order, annotated with days remaining or days overdue. Essential for compliance p
Get obligation counts grouped by regulation_code. Returns total count and per-regulation breakdown with status counts (active, upcoming, overdue, expired) plus verified and with_deadline counts. No fu
Get recently published or updated regulatory documents. Shortcut for 'what is new this week' - returns documents from the last N days, sorted by publication date (newest first). Useful for weekly regu
Get verification progress for obligations across all regulations. Returns total, verified, unverified counts overall and per regulation, with percentage verified. Use this to track human review progre
Get available actor roles per regulation with obligation counts. Actor roles define WHO an obligation applies to within a specific regulation (e.g. 'credit_institution', 'significant_institution' for
Get the calling company's regulatory posture — saved entity types, actor roles per regulation, and active conditions. The profile defines WHICH regulations and roles apply to this company. Use the act
Get enforcement decisions with structured penalty data. Returns enforcement actions (fines, warnings, license withdrawals) imposed by regulators. Each action includes penalty amount, sanctioned entity
Audit the actor role taxonomy: compare model-defined roles vs deployed roles in the database. Returns per-regulation analysis showing: - model_only: roles the enrichment model can produce but aren't i
Get user feedback for QA review. Requires admin API key. Filters: status (new/reviewed/resolved/dismissed), feedback_type (data_quality/bug/feature_request/other), context_type (document/obligation/ge
Return the canonical Finlex URL for a Finnish statute so Claude can fetch its text. Finlex (finlex.fi) is the official Finnish statute database — no public JSON API exists, but the URL can be fetched
Return Finlex search URL for Finnish statute keyword search. Finlex has no public JSON search API — returns the search URL for Claude to fetch. Args: query: Search terms in Finnish or English (e.g. 'k
Look up a Finnish company in the PRH Trade Register by business ID (Y-tunnus). Returns company name, status, registered address, company form, registration date. Args: business_id: Finnish business ID
Search Finnish companies by name in the PRH Trade Register. Use to find a business ID when you only know the company name, or to check whether a company name is already taken. Args: name: Company name
Return verbatim obligation text from the Velvoite corpus for an EU regulation article, plus the canonical EUR-Lex URL for reference. Queries the Velvoite corpus directly — no web fetching required. EU
Return EUR-Lex search URL for finding regulation provisions by keyword. Use when you don't know the exact article number but need to find relevant provisions. Requires Velvoite Premium API key. Args:
Search CJEU case law via EUR-Lex CELLAR SPARQL (live — not limited to Velvoite corpus). Returns cases matching keywords in the case title. Use to find court decisions on a specific regulation, topic,
Look up any EUR-Lex document by CELEX number via CELLAR SPARQL (live). Returns title, date, and URLs for the full text. For CJEU case law (CELEX starting with 61 or 62): queries CELLAR SPARQL and retu
Return access details for a Finnish Supreme Administrative Court (KHO) precedent decision. Requires Velvoite Premium API key. KHO decisions are cited as KHO:YYYY:N (e.g. KHO:2024:52). Use search_kho_d
Return a search query to discover KHO (Finnish Supreme Administrative Court) precedent decisions for a given year. Requires Velvoite Premium API key. NOTE: The Finlex listing page is client-side rende