Ansvar Gateway is a single MCP endpoint for regulatory compliance work. Ask for the law and it returns the actual provisions — GDPR, NIS2, the EU AI Act, DORA, CRA, and national statutes across the EU and dozens of other jurisdictions, plus standards, case law, preparatory works, and regulator guidance. Every row carries a paragraph-level citation with source URL, publisher, and license, fetched from the official publisher, never a mirror. It also serves live CVE/KEV/EPSS vulnerability data and MITRE ATT&CK/CAPEC/CWE, and runs guided compliance workflows (threat modeling, DPIA, gap analysis) from your own MCP client — Claude, Copilot, ChatGPT, or any MCP-capable agent. If a source is unavailable it says so rather than answering from model memory. Auth is OAuth 2.1 with Dynamic Client Registration; a free tier is available for business users at ansvar.eu.
search requires at least one jurisdiction, framework, sector, or source; it does not auto-detect scope from the query. Ansvar security & compliance intelligence gateway — 300+ law / regulation / standards corpora, live threat intelligence (CVE / KEV / EPSS), and compliance workflows behind a few unified tools.
DISCOVER FIRST (don't dump data to find out what exists): call get_my_capabilities (light — your tier, limits, quota) or describe_capabilities (tier-aware catalog of corpora + workflows; compact summary by default — pass detail='full' or section='sources'|'addons'|'tour'| to drill in).
NEW OR UNSURE USER? Offer the guided tour: invoke the ansvar-tour prompt, or call describe_capabilities(section='tour') for the guided-tour script. Free-tier safe.
search NEEDS A SCOPE — pass at least one of jurisdictions= (e.g. ['SE','EU']), frameworks= (e.g. ['GDPR','TLS']), sector=, or sources= (a corpus id); with no scope it errors. Use get_provision to fetch a specific article/section by id.
Standards corpora are reached via sources=/frameworks= — e.g. IETF security RFCs: search(query='TLS 1.3', sources=['ietf-rfcs']) or frameworks=['TLS']. Premium corpora (case law, agency guidance, IETF RFCs, …) need premium+ tier; describe_capabilities flags what your tier can reach.
RUNNING A WORKFLOW? Call list_workflow_types first for the authoritative live type ids, deliverables, required inputs, and caller availability; then pass the chosen id to start_workflow. Do not infer the catalog from examples.
CITING AN UPLOADED DOCUMENT? Resolve segments with resolve_document_segment and present each citation as a numbered marker [n] with a References list (doc:// URI + content hash); on HTML surfaces use clickable chips + an evidence ledger. The cite-document prompt has both rendering styles. Quote verbatim and keep the hash.