batch_search
ChatGPTGet details for multiple CVEs in one query (max 100). Efficient for bulk vulnerability assessment.
Security
Overview
Ansvar Systems AB is a Swedish cybersecurity company that gives AI agents verifiable access to law, regulation and security standards. Customers connect the AI assistant they already use (Claude, Microsoft Copilot, ChatGPT or any MCP-compatible client) to the Ansvar Gateway and run compliance work directly in that assistant: regulatory gap analyses, threat models (STRIDE/LINDDUN, TARA), DPIAs and audit preparation, grounded in more than 300 curated corpora of EU and international legislation, case law, preparatory works, regulator guidance and security standards. Every answer carries paragraph-level citations to the official source. When a source is unavailable, the platform returns an error instead of guessing, accuracy over availability is an architectural rule, not a disclaimer. All content is ingested from the original publisher under verified licensing, so results can be relied on and redistributed. Ansvar serves legal insurers, compliance teams, security consultancies and software teams that need to know which rules apply; NIS2, GDPR, DORA, CRA, the EU AI Act, national and sector regulation — and to prove where every answer came from.
Tools
cancel_workflow
ChatGPTCancel an active workflow by id. Cancelled workflows cannot be resumed and are excluded from resume_workflow's active listing; their record stays visible in list_workflows. Idempotent — cancelling an already-cancelled workflow returns the same result.
check_kev_status
ChatGPTCheck if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Returns KEV details including required remediation actions and due dates.
create_dfd
ChatGPTValidate a DFD artifact and render it as styled Mermaid. Returns {mermaid, validation_errors, structural_warnings}. Use after the DFD specialist (/threat-modeler-dfd) has finished extraction so the graph integrity (valid node types, declared trust_zones, reachable edge endpoints, recognised regulatory tokens) is checked before the artifact is submitted via submit_response on scoping.component_identification. artifact = {nodes, edges, trust_zones, assets}, each a list. node: {id, type, trust_zone, name?} where type is one of process|data_store|external_entity|actor and trust_zone references a trust_zones[].id. edge: {src_node, dst_node, id?, protocol?, authentication?, encrypted?, crosses_boundary?} where src_node/dst_node reference node ids (from/to accepted as aliases). trust_zone: {id, name?}. asset: {owner_node, id?, regulatory_relevance?} where owner_node references a node id and regulatory_relevance tokens are one of GDPR|PCI_DSS|DORA|NIS2|EU_AI_Act|HIPAA|ePrivacy|EBA|EIOPA. Bad input returns validation_errors with mermaid=null; it never raises.
describe_capabilities
ChatGPTDiscover what Ansvar can do for your agent. Default (detail='summary') is a compact orientation view: one-line about, your tier summary, counts, a per-category index (id, name, available_to_caller, min_tier, entry_hint, tools/workflows counts, caveats for gated families), meta tool names, next_steps, the paid add-ons directory, and a sources count with a drill-down pointer. detail='full' returns the complete catalog (large — over 100k chars): category prose, the intent-keyed
common_use_cases map, anti_patterns, guidance, the tour, and the full sources directory. section='sources' | 'addons' | 'tour' | <category id> returns that one section alone; an unknown section is an error listing the valid ids. section='sources' returns 4 entries by default: compact entries carry a one-sentence address for corpora with get_provision; detail='full' replaces address with lookup, including served shapes, shares, examples, declared form, prefixes and addressing guidance. Filter by query, declared domain or jurisdiction; continue with next_cursor as cursor. query, domain, jurisdiction, cursor and limit require section='sources'. detail is validated before section: an invalid detail is an error even when section= is passed. Every view is tier-aware: available_to_caller flags and caveat text reflect the caller, and gated families are shown with caveats, never silently omitted. The workflow lists are reconciled at read time against a TTL-cached snapshot of the live workflow registry (background-refreshed, 15 min): workflow_types_index carries the snapshot status (live / stale / unavailable) and fetched_at, plus registry types the curated catalog does not list yet; catalog_drift lists catalog ids the registry no longer serves (dropped from the payload). service_notices names subsystems in a known degraded state and the exact tools affected; a category's tool_status marks a catalog tool that currently dispatches on zero scopes fleet-wide and is withheld from tools/list and the category roster until a feed serves (e.g. get_changes during the baseline-only interim), with the same reason_code the tool's own refusal returns. Companion to get_my_capabilities (live tier / quota only). Backed by this repo's data/capabilities-catalog.yml (mirrored for documentation as infrastructure/gateway/capabilities-catalog.yml in arch-docs).diff
ChatGPTCompare two versions of a legal provision to see what changed. Use this when someone asks 'what changed in the latest DORA amendment', 'how did this article change between versions', or 'show me the differences in GDPR Article 17 after the update'. Returns a structured diff with added, removed, and modified text. The response ends with a 'Sources used' section — a markdown table carrying the audit receipt for each returned row, or a labelled zero-result note — and meta.render_contract carries the versioned evidence-curation contract for reproducing source attributions when the answer is rendered. The text content is the JSON response on its first line, then a blank line, then that markdown section; read the JSON from the first line only.
discover_eu_legislation
ChatGPTFind EU legal acts by CELEX/ELI identifier, official title, reviewed alias, or LEXICAL match on title and EuroVoc labels (not semantic); filter by EuroVoc topic id or label, Ansvar sector, document type and availability. Returns bounded candidates with per-edition currency state and hold reasons, a framework crosswalk to eu-regulations where the same act is keyed there, and exact search/lookup hints.
generate_report
ChatGPTProduce the final compliance report from a completed workflow. Use this when someone says 'generate the gap analysis report', 'I need the DPIA report as a document', or 'create the threat model output'. Refuses until every quality gate passes, returning the failing check and a hint. Returns a structured report with findings, citations, and recommendations. Pass format html, pdf, docx, or all to additionally receive branded rendered artifacts as short-lived download URLs in a sibling render key; render failures attach render_error and never drop the report JSON. Rendering is served by the document plane and starts at the premium tier; on free and solo an included run also returns html or pdf carrying an Ansvar watermark, and outside an included run free and solo receive the report as JSON. A format the caller's tier does not serve is refused explicitly rather than quietly downgraded.
get_changes
ChatGPTFind observed rows from legislative change feeds in a jurisdiction or framework, or from an explicit source. Use this for questions such as 'what laws changed in Sweden this month' only when the requested scope is listed as amendment-capable. If since is omitted, the gateway defaults to the last 90 days. Coverage is per corpus. The EU Regulations source is baseline-only during the current interim: it is excluded from amendment-capable dispatch, and a framework it owns is advertised only if another reachable feed supports that framework. A successful empty response is not evidence that no amendments occurred. On a capability miss, the response names supported source, framework, and jurisdiction scopes — or, when no corpus advertises change feeds at all, says so explicitly with supported_scopes empty on every axis. Every dispatched response reports whether baseline rows were actually withheld and whether the producer supplied typed event metadata. Legacy rows without typed event metadata remain visible with event_kind unknown. A scope value that names nothing we serve is refused, not ignored: the call errors and names the value, never returning changes for only the part that resolved. Use diff for a known provision. Boundary: this tool reports amendments observed in SERVED corpus text; for newly published official acts and regulator announcements (what is new, not what changed in a text we serve), use search_regulatory_updates. The response ends with a 'Sources used' section — a markdown table carrying the audit receipt for each returned row, or a labelled zero-result note — and meta.render_contract carries the versioned evidence-curation contract for reproducing source attributions when the answer is rendered. The text content is the JSON response on its first line, then a blank line, then that markdown section; read the JSON from the first line only.
get_current_step
ChatGPTCheck which step a compliance workflow is currently on and what input is needed next. Use this when someone asks 'where are we in the gap analysis', 'what's the next step', or 'what do I need to provide now'. Returns the current step description and expected input format. questions_for_user is advisory — answerable from context or uploaded documents; requires_user_input=true is the server-enforced human-input gate, and the step then lists user_provided_fields that must be filled before calling submit_response.
get_cve_details
ChatGPTGet complete details for a specific CVE including CVSS scores, references, CPE mappings, KEV status, EPSS score, exploit references, and any CISA ICS/OT advisories (ICSA/ICSMA/ICSV) referencing it with their affected industrial products — use this to enrich an OT/ICS or robot-cell TARA with live advisory context.
get_data_freshness
ChatGPTCheck the freshness and sync status of all data sources. Returns last sync time, data age in hours, record counts, and health status (current/stale/critical) for each source: NVD, CISA KEV, EPSS, ExploitDB. Use this to verify data is up-to-date before making security assessments.
get_epss_score
ChatGPTGet the EPSS (Exploit Prediction Scoring System) score for a CVE. Returns the probability of exploitation in the next 30 days and percentile ranking.
get_exploits
ChatGPTGet public exploit code references for a CVE from Metasploit, ExploitDB, GitHub PoCs, and other sources.
get_ics_advisory
ChatGPTGet full details of a CISA ICS/OT advisory including affected products (vendor + product + version range), referenced CVEs with CVSS, summary and the CSAF source URL. Public-domain CISA CSAF data.
get_my_capabilities
ChatGPTTier, capabilities, limits, and live usage for the calling identity. Use this to decide what tools and fan-out paths are available before calling them, or to check remaining quota before issuing more requests — agents can avoid wasted retries rather than discover limits by hitting walls. Visible to all tiers; takes no arguments. Returns a JSON document with: tier (free/solo/premium/team/company), capabilities (workflows, audit_ledger, include_premium_fanout — bool flags from ADR-026 §2 and ADR-032 §1), limits (max_concurrent_jobs, daily_quota — map tool→limit from ADR-028 §4, listing only tools your tier, scopes, and actor policy admit), with daily_quota_note when tool rows share a budget. At the free tier, the provision-body lookups (get_provision, validate_citation) share one 200 calls/day budget; daily_quota_note names every tool on it. usage_today (active_concurrent_calls, remaining_quota — map tool→remaining, both read live from the configured cap store; team/company budgets pool per organisation, so seats of one org see a shared remaining number), documents (Team and Company only: count, cap and remaining for your organisation's registered-document library, read live from the document service; count and remaining are null with an unavailable_reason when that read fails, never zero), tool_surface (tool_count and a 16-character fingerprint of the caller-scoped tools/list, computed_at in UTC, and a refresh_hint for detecting a stale client-side tool cache), workflow_discovery (present only when you can start a run — the three calls that take you from here to a running workflow: list_workflow_types for the live type ids, describe_capabilities for the catalog, start_workflow to begin; the type ids come from that call, never from this one), upgrade_url (always empty on this connection), and service_notices — subsystems currently in a known degraded state, each naming the exact affected tools/add-ons and the reason those tools return, so an advertised capability that is temporarily down is never a surprise (empty list when everything is healthy). Counters reset at UTC midnight. With Redis configured, daily quota and concurrency are shared across workers and replicas; adding workers does not multiply the allowance. Development without Redis uses in-memory counters local to each process.
get_progress
ChatGPTSee how far along a compliance workflow is and which steps remain. Use this when someone asks 'how much of the gap analysis is done', 'what percentage is complete', or 'how many steps are left'. Returns completed and remaining steps with a progress percentage and quality score.
get_provision
ChatGPTLook up the exact text of a specific legal provision or standards-catalog control. Three addressing forms: (1) jurisdiction + law + article — use this when someone asks 'show me Article 5 of GDPR', 'what does Section 12 of the Swedish Work Environment Act say', or 'read me the text of DORA Article 11'. A U.S. federal regulation is addressed by its CFR citation: get_provision(jurisdiction='US', law='45 CFR', article='164.410') (also '45 C.F.R.' + '§ 164.410', or law='45 CFR Part 46' + article='Part 46' for a part) reaches the one corpus that serves that CFR part; (2) canonical_ref — the exact ref a
search row's citation.lookup hint advertises (e.g. get_provision(canonical_ref='loi-2018-07-30:art-64', jurisdiction='BE')): the gateway decomposes it and resolves the same way. Pass jurisdiction alongside canonical_ref when the ref does not embed one (relayed hints already include it). (3) law as a bare corpus/source id + article as the native control/entity id, NO jurisdiction — for non-jurisdictional standards catalogs (e.g. get_provision(law='nist-800-53', article='AC-5') for NIST SP 800-53, and the same shape for nist-csf-2, nist-800-82r3, nist-ai-rmf, nist-ssdf-800-218): a search row's citation.lookup hint for these corpora already advertises this exact shape — replay it verbatim. For a national statute you have not seen in a search row, search first and replay that row's citation.lookup; a law name resolves only where Ansvar has an alias for that name. Returns the full provision text with citation metadata. A member-state jurisdiction plus an EU framework article that has a verified national transposition returns the NATIONAL transposing provision, with meta.transposition naming the swap; pass jurisdiction='EU' for the framework text itself. Where no such mapping applies, the same field may instead carry a typed disclosure describing Ansvar's verified coverage for that pair. When a national transposition IS served, the CELEX and instrument name that response reports are themselves valid law input in that jurisdiction — replay either. When a law name matches several documents or does not resolve (near matches, reason_code=law_name_unresolved), each meta.ambiguous_candidates item is an executable get_provision retry: retry_args contains jurisdiction, law (the chassis doc_id), and the original article, or jurisdiction plus canonical_ref when the resolver supplied one; retry_kind identifies which addressing form it uses, and label carries the served document title (up to 120 characters, empty when unavailable). The response ends with a 'Sources used' section — a markdown table carrying the audit receipt for each returned row, or a labelled zero-result note — and meta.render_contract carries the versioned evidence-curation contract for reproducing source attributions when the answer is rendered. The text content is the JSON response on its first line, then a blank line, then that markdown section; read the JSON from the first line only. Search lookup hints may include source_id, the exact routed corpus that served the row. It is valid only with the hint's nonblank canonical_ref; law and article must remain empty. Replay the whole args object unchanged so a document present in multiple corpora cannot be substituted. Do not infer source_id from the legal document id.get_regulatory_intelligence_status
ChatGPTReport what this service actually monitors and how current each source is: the enrolled sources, their publisher, channel kind and jurisdictions, when each last synced successfully, its freshness state (current / stale / critical / unfetched / baseline-only), how many records it holds, and when its baseline backfill ran. Also reports the state of the signed licensing verdict that governs which sources may be fetched at all. Read this before concluding anything from an empty search: a source that is not enrolled, or whose state is critical, is not covered, and this tool says so plainly.
enrolled means the current verdict clears the source AND its acquisition proof is verified. Also reports the state of the curated obligations calendar behind get_regulatory_deadlines: obligations.dataset_state is ok (the newest signed dataset is what serves), degraded (a newer dataset exists that this service could not read, so the previous one is still serving — resolution_reason says why, anomalous_release names the release, degraded_since says when that was last confirmed), or unavailable (none ever loaded, so the deadlines tool refuses). It also reports how many curated rows and pending-instrument rows are held, when the curators last changed the dataset, and which signed generation this service consumed. That is the free surface for a premium tool — a caller whose deadlines request refused, or came back degraded, can find out here why, without a tier. The lane_f block reports the fleet-derived event lane: publications detected on the official indexes the corpus fleet itself watches, consumed only when THREE gates pass — the signed licensing verdict clears the fleet source (with verified acquisition), a signed per-target eligibility decision exists at the detection's exact target configuration digest, and a current signed events artifact verified. It carries the events-artifact state, the inbox counts (pending / stored / invalid), and suppressed_duplicates — publications observed by both an enrolled registry source and a fleet target are served ONCE, by the registry lane, and every suppression is counted here rather than silently dropped. The verdict block also carries disposition_summary: the disposition-class counts exactly as the consumed signed artifact delivered them, or null. Null is 'this service has no counts to report' and never 'the register is empty' — the consumed generation carried none, no verdict has been consumed yet, or this server is running ahead of the migration that stores them. Its keys are exactly enrolled_event_feed (fleet event-feed sources in the signed launch set), cleared_event_feed (how many of those the verdict clears) and register. register is one of exactly two shapes: the projection, whose keys are exactly generated_at, fleet_sha, total_rows, by_disposition (keys exactly event_feed, signal_only, blocked) and unclassified; or unavailable_reason alone, which says the register could not be read when the artifact was published. The register numbers project a separate artifact generated at its own time — read its generated_at and fleet_sha before comparing them with anything else here, and read unclassified before treating the classes as complete. Example: "Using Ansvar, which regulatory sources are you monitoring and how fresh are they?"get_workflow_threats
ChatGPTReview the threats identified during a threat-modeling workflow. Use this when someone asks 'what threats were found', 'show me the risk assessment results', or 'list the identified vulnerabilities'. Returns threats with severity ratings and recommended mitigations from completed STRIDE analysis steps.
list_coverage
ChatGPTShow which countries, frameworks, and legal domains are available. Use this BEFORE calling
search when the user's topic doesn't name a jurisdiction (e.g., 'what does the law say about consumer protection'); then present the returned jurisdictions to the user or ask which applies. Examples: • 'Which countries do you cover?' → list_coverage() • 'Do you have German law?' → list_coverage(jurisdiction='DE') • 'What jurisdictions for NIS2?' → list_coverage(domain='cybersecurity') • 'Which countries have drone law?' → list_coverage(domain='aviation') (also accepts 'drone' / 'uas') • 'Which countries have court decisions?' → list_coverage(content_kind='court-decisions') Returns a jurisdictions array (each with code, name, region, laws, provisions, domains, content_kinds, counts_complete, and uncounted_sources) plus framework and source listings. An incomplete-count row also carries coverage_note explaining why. NOTE: laws/provisions are WHOLE-JURISDICTION corpus totals — the response's count_scope is whole_jurisdiction. Under a domain filter the jurisdiction list is narrowed to that domain but the counts are NOT domain-scoped; do not report them as a per-domain count. The domain-specific signal is the (domain-filtered) sources/frameworks.list_workflow_types
ChatGPTFind the authoritative live structured-workflow registry. Call this before start_workflow instead of guessing an id from examples or a static catalog. It covers every deployed workflow family, including risk/TARA, DPIA/FRIA, regulatory and medical-device gap analysis, procurement, document review, drone/OT workflows, and vulnerability decisions. Each entry carries workflow_type, base_type, display_name, description, produces (the final deliverable), required_slots, overridable_configurable, legal-review state, plus gateway-added minimum_tier and available_to_caller fields. Every tier sees the full directory; which rows are marked available depends on the caller's plan. A row locked by TIER carries tier_caveat: which plan runs it — so a tier-locked row is never a bare false. Discovery service failures and malformed responses fail explicitly; no static list is returned as if it were live.
list_workflows
ChatGPTList your organisation's workflows (id, type, status, current step, last update). Filter with status='active', 'completed', or 'cancelled'. Results are paginated with limit (default 20, max 100) and offset; follow next_offset until null. Use it to recover a lost workflow_id or review past assessments.
recommend_subagents
ChatGPTPlan the parallel sub-analyses for a threat-modeling phase. Given the current phase of a threat_model workflow (its id comes from get_current_step) and your workflow context, returns the recommended breakdown: which analysis prompts to run, with what arguments, which can run in parallel, and an inline fallback for MCP clients that cannot invoke prompts. phase_id is one of: phase_0b_scope_check, phase_1_scope_and_dfd, phase_2_stride_enumeration, phase_2b_domain_challenge, phase_3_scoring, phase_3b_threat_enrichment, phase_5_mitigation, gap_assess_controls. Optional — the workflow works without it; use it to speed up large systems by fanning phases out to subagents.
resume_workflow
ChatGPTContinue a compliance workflow that was paused or interrupted. Use this when someone says 'let's continue the gap analysis', 'pick up where we left off on the threat model', or 'resume my DPIA'. Requires the workflow_id from the original start_workflow call.
scope_workflow
ChatGPTScope a compliance workflow down to ONE concrete workflow id before spending a run. This answers what the catalog cannot: which of the registry's ids fits THIS user's system, jurisdiction and framework. Call it with whatever you already know — every argument is optional — and it returns either the next scoping question with its allowed options (put that question to the user, then call again with their answer) or the single workflow_type to start, why that one, whether this caller may run it, and which plan runs it if not. Unmetered and visible at every tier: scoping never spends a run, and the recommendation is the same id whatever the caller pays, so the answer does not depend on the caller's plan. Deterministic — questions, options and the recommendation are projections of the workflow registry, never a guess. Every answer carries the registry snapshot it was computed from (fetched_at, age_seconds): the snapshot refreshes on an interval, so re-scope rather than replay an id across a registry change, and treat list_workflow_types as the authority when the two disagree. Typical opening: the user says 'Using Ansvar, we need a NIS2 gap analysis for our Dutch plant' — call scope_workflow(objective='gap_analysis', framework='nis2', jurisdictions=['NL']), then pass the id it returns to start_workflow. Ambiguity comes back as the next question, never as a list of maybes, and every question's options are the complete set this tool accepts — for a framework it does not list, call list_workflow_types and start_workflow directly. A missing or stale registry snapshot fails explicitly; no static catalog is served as if it were live.
search
ChatGPTSearch requires at least one jurisdiction, framework, sector, or source; it does not auto-detect scope from the query. Use for 'what does the law say about X in country Y' or 'which regulations cover Z'. QUERY SHAPE: queries are keyword-matched (FTS5, implicit AND — every term must occur in the SAME provision). Pass one or two canonical concept terms per call; never a multi-concept compound. A compound such as 'incident reporting deadline personal data breach' returns 0 even when each concept on its own returns hits — so ask one concept per call and combine the answers yourself. Two terms describing ONE concept ('personal data') are fine; 2-3 alternative terms can be joined with a bare uppercase OR (e.g. 'spoofing OR tampering' matches either term). OR is for synonyms of ONE concept, not for related concepts — 'dismissal OR termination' yes, 'encryption OR breach notification' no (ask those one per call). Other FTS operators (AND, NOT, NEAR) are stripped. STRICT MISS: when a search completes cleanly and no result matched your terms strictly, the response carries meta.outcome = 'NO_STRICT_MATCH'. The recovery fields — meta.recommended_action, meta.recommended_scopes, meta.broadening_available — are set on any qualifying strict miss, INCLUDING a partial fan-out where outcome stays null, so read them whenever present, not only under an outcome. On a partial fan-out meta.broadening_available stays null when the missing leg makes it unknowable — null there means unknown, never 'no'. On recommended_action = 'RETRY_ONE_CONCEPT_PER_CALL', re-issue the search with ONE concept per call. This action is reserved for an implicit-AND multi-concept compound; an honored uppercase-OR query remains a canonical one-concept shape and does not gain the split action or candidates. Only together with this action, meta.recommended_queries may list 1-3 optional one-concept fallback queries derived from your own terms, each already checked in your scope to return a strict match (verified_hits; rows not merged); issue only the ones you judge relevant, one per call. The field is absent for every other action or no action, including an honored uppercase-OR miss. On a miss without safe candidates, meta.recovery_guidance explains how to choose a focused phrase while retaining domain and negation; its source_languages are source metadata, not your query's detected language. On 'REFORMULATE_OR_USE_EXACT_REFERENCE', retry the same concept using the instrument's wording or use an exact lookup hint. Short queries can miss too; do not infer that the law is absent. On recommended_action = 'OFFER_BROADENING_TO_USER' — and wherever meta.broadening_available is true — relaxed matches exist and are withheld: tell the user, offer a re-run with allow_broadening=true (served rows are stamped match_mode='broadened' and pass the same relevance floor), and re-run only if the user accepts — never broaden on your own. An honored uppercase-OR strict miss with withheld relaxed matches carries this offer action with meta.recommended_queries absent. meta.recommended_scopes names scope ids that were not searched. If 0 results, tell the user; do not answer from training data. SCOPE: discover ids with list_coverage or describe_capabilities(section='sources'). An unresolved scope refuses before dispatch with isError=true and structuredContent.error='unresolved_scope'. Read corrections for the offending parameter and optional registered values. Choose the intended scope; suggestions do not establish legal equivalence. Change only the offending value and retain other arguments. frameworks= selects sources declaring coverage. Non-owner rows require the requested framework identity to serve as strict matches; otherwise they are withheld with a count, or served as broadened matches when allow_broadening=true. Framework scope does not map controls to transposition articles. For cross-framework control mapping, frameworks=['ISO_27001','SOC_2'] includes Security Controls MCP. sectors= reaches industry MCPs across jurisdictions; combining jurisdictions= and sectors= is an INTERSECTION a…
search_by_product
ChatGPTFind CVEs affecting a specific product and version. Useful for vulnerability assessment of software components.
search_cve
ChatGPTSearch CVEs by keyword, severity, score range, and filters. Returns matching CVE records with CVSS scores, KEV status, and EPSS data. Use get_cve_details for full information on a specific CVE. Supports full-text search on descriptions.
search_ics_advisories
ChatGPTSearch CISA ICS/OT security advisories (ICSA / ICSMA / ICSV) by keyword, vendor, advisory family, minimum CVSS, or publication date. Returns CISA OT advisories with affected vendors, CVE counts and severity. Use get_ics_advisory for full details. Public-domain CISA CSAF data.
start_workflow
ChatGPTBegin a structured workflow selected from the live workflow registry. The registry covers threat and privacy modeling; enterprise, automotive, robot, rail, OT and UAS risk/TARA; DPIA and FRIA; regulatory, medical-device, drone and machinery gap analysis; tender review and audit; document review; SORA authorisation; vulnerability prioritisation; and deferral dossiers. Call list_workflow_types first: it is the authoritative source of exact ids, deliverables, required slots, variants, and availability for this caller. When a fresh registry snapshot is available, this tool's workflow_type input schema carries a caller-authorized enum; otherwise it remains a string rather than silently falling back to a stale catalog. The workflow engine guides the process step by step with quality gates. Each step's questions_for_user is advisory — answerable from context or uploaded documents; only steps returning requires_user_input=true carry the server-enforced human-input gate. Which types you can start depends on the caller's plan: list_workflow_types marks each row available_to_caller and names the plan that runs a locked one. On the free and solo plans the framework argument accepts only nis2, dora, cra or eu_ai_act, and the base gap_analysis needs one of them. A start SPENDS a run from the monthly allowance, and on free and solo a cancel does not hand an unused one back — name the workflow_type you intend to the user and get their OK before calling this, and check get_my_capabilities for what is left.
submit_response
ChatGPTProvide an answer to the current step in a compliance workflow. Use this when someone provides information requested by the workflow, such as 'our system processes health data' or 'we use AES-256 encryption'. The workflow engine validates the response and advances to the next step. Pass user_acknowledged=true only after the user has supplied the fields listed in user_provided_fields. evidence_references accepts document UUIDs, doc:// segment URIs, or regulatory URLs. For an unattended gate, pass approved_by='auto' and leave user_acknowledged=false so the report does not misrepresent automation as human review. approved_by accepts only 'auto'; human review is asserted via user_acknowledged, never by naming an approver.
validate_citation
ChatGPTVerify a legal citation against the served corpus: confirms the cited provision exists and is retrievable, and returns its current served text so a quoted claim can be compared against what the provision says now. Use this when someone asks 'is this citation correct' or 'check whether Article 28 GDPR still says this' — answer the latter by comparing the returned text with the claim. It does NOT assert legal in-force status and does NOT consult amendment feeds; a valid verdict means the citation resolves in the corpus we serve. For a provision-level change comparison use diff. The response ends with a 'Sources used' section — a markdown table carrying the audit receipt for each returned row, or a labelled zero-result note — and meta.render_contract carries the versioned evidence-curation contract for reproducing source attributions when the answer is rendered. The text content is the JSON response on its first line, then a blank line, then that markdown section; read the JSON from the first line only.
validate_claim
ChatGPTCheck a claim graph before relying on or presenting its conclusions. Refetch cited provisions and evidence under your scope, compare quotes, inspect dependencies, and report the result with explicit checked/not_checked lists. Evidence checks and judgment are separate fields on every node: evidence_checks (source_resolution, quotation_match, served_language, dependencies) records what the checker established; agent_assessment.declared_typing records the DET/INT typing the agent declared, attributed to the agent; evidence_ceiling is the highest typing the checked evidence permits; claim_support is always not_checked, because whether evidence supports a claim is reasoning and this check evaluates none. A matched quotation and a DET evidence_ceiling do not mean the conclusion is supported. On interpretations and conclusions, evidence_checks.stated_quantities reports whether each plain deadline, duration, percentage or euro amount in the statement appears in the cited text (all_in_cited_text, not_in_cited_text, not_checked, not_applicable; English only; stated_quantities_detail lists the missing and cited values); not_in_cited_text is a fact about the text, not a finding that the conclusion is false (a value may be derived), and claim support stays not_checked. strength is the legacy name for evidence_ceiling. A resolved evidence node (non-provision) carries a resolution verdict and caps every dependent conclusion at UNVERIFIED. Optionally check quotations in the prose answer. This does not verify legal in-force status, facts, satisfiability, entailment, or whether logic expresses the law. Served-to-this-caller verification (G4) is not checked: served rows do not yet carry request-id binding. No overall pass verdict is returned. Refetches run with concurrency up to 6 under a shared 25-second deadline; the session pool defaults to 2 sessions per downstream URL. Expiry returns bounded=true and unreached_clauses (count); unfinished clauses are unavailable, UNVERIFIED, and in not_checked with reason refetch_budget_exhausted. The summary.display_markdown field contains the presentation text, with findings and disclosures in summary.attention_items.
verify_citations
ChatGPTVerify submitted legal citations against what this gateway actually serves, so a report can record which of its citations are established evidence and which are not. For each subject you supply a reference (and the source_id the row's citation.lookup hint carried, plus the quotation your text relies on), the gateway re-retrieves that provision under YOUR scope through the source-pinned exact lookup, checks the PRODUCER-declared identity of the row it got back against the reference you asked for, and only then compares your quotation with the retrieved body. A displayed reference is never used to decide which row answers a subject. Verdicts per subject: quote_checked (reference resolved and the quotation is in the body), reference_resolved (reference resolved, no quotation was submitted), quote_mismatch, no_quotation_submitted (a quote-bearing subject whose quotation was empty — a refusal, NOT a mismatch), identity_mismatch (the row's producer identity names a different provision), identity_absent, reference_unparseable, not_served, withheld and unavailable. Coverage is advertised, never assumed: producer identity exists TODAY ONLY on the source-pinned exact lookup paths, so a subject with no source_id, or one on a corpus they do not cover, returns identity_absent rather than passing. Entity subjects are the second such path: when source_id names a controls, framework, standards or threat-technique catalog, reference is that row's entity id (a control, clause or technique id such as AC-4(5), A.5.1 or T1059) and the gateway re-retrieves it from that catalog by id — the lane follows the source, not the shape of the string. Court decisions and preparatory works are the third: when source_id names a decision or preparatory-works corpus, reference is that row's single opaque address (an ECLI, a neutral citation, the corpus's own case id, a proposition number) and the gateway re-retrieves it FROM THAT CORPUS — never from another decision corpus of the same jurisdiction — and additionally requires the producer's own court, case number and decision date before a decision verifies. Both lanes compare references byte for byte: these id spaces carry no equivalent spellings. For those two lanes source_id is the ROUTED CORPUS ID the row came from (for example dutch-court-decisions or swedish-preparatory-works), because a decision hint carries the reference and the jurisdiction, not the corpus. It is not the citation's mcp_server, which is that corpus's display name and resolves to no routed id; the response's coverage block lists the corpus ids each of these lanes covers today. Regulatory updates are the fourth: when source_id names the regulatory-update service, reference is the record id that service emitted and the gateway re-fetches that record from it, byte for byte. Because a regulatory update is a live feed rather than a built corpus, such a verdict also carries a freshness block — the record's own publication and observation dates, the feed it came from and that service's own reported data age — and a verdict this gateway cannot date refuses (identity_absent) instead of establishing. A quotation on this lane is compared with the publisher's own title text, which is the only verbatim text the record carries: the service serves no summary and no provision body. CVE records are the fifth: when source_id names the CVE service, reference is the CVE id (CVE-2021-44228) and the gateway re-fetches that record from it, byte for byte, comparing a quotation with the publisher's own description. Such a verdict carries a freshness block too — the record's publication and modification dates, and the declared sync state, age and interval of the feed it was served from — and because that service publishes its own freshness contract, a feed it reports as no longer current, or one older than the sync interval it declares for itself, answers identity_absent with reason cve_pin_feed_stale instead of establishing anything — and so does a miss from such a feed, because an absence read from a stale mirror is not an absence. A KEV listing or an EPSS …
Capabilities
Writes
Example Prompts
Click any prompt to copy it.
