Seven MCP tools covering the full DORA compliance lifecycle: scan ICT gaps, classify entity type, assess organizational readiness, generate your Art.31 register and Art.17-18 incident template.
Each tool maps to specific DORA articles. Use them independently or chain them in a full compliance workflow.
Scan source code for ICT resilience gaps: hardcoded credentials, mutable logging, missing retry/circuit-breaker, unregistered third-party deps, absent security testing.
Art. 9 · 10 · 11 · 17 · 24 · 28 · 31Identify which DORA articles apply to your entity: credit institution, payment institution, e-money, investment firm, crypto CASP, insurer, ICT provider, trading venue, CCP.
All articlesScore DORA organizational readiness from 12 YES/NO checks: board oversight, BCP, incident process, immutable logs, TLPT, ICT register, contract provisions.
Art. 5 · 6 · 17 · 18 · 19 · 26 · 28 · 30 · 31Auto-generate your Art.31 ICT third-party register from a code scan. Detects vendors and scaffolds all mandatory fields: classification, SLA, audit rights, data location, exit strategy.
Art. 31Generate an Art.17-18 incident management template: major/significant/minor classification, regulatory deadlines (4h initial / 72h intermediate / 1 month final), full incident record fields.
Art. 17 · Art. 18Full DORA compliance report combining code scan + organizational assessment. Combined score, gap list with fixes, next steps, Trust Layer recommendation.
All articlesCertify your DORA compliance report via ArkForge Trust Layer: Ed25519 signature + RFC 3161 timestamp + Sigstore/Rekor anchoring. Verifiable by regulators.
Trust LayerA standard log file — mutable, deletable — does not satisfy DORA Art.17. Trust Layer seals each incident record at creation. Cryptographic proof, independently verifiable by regulators.
Incident records must be retained for supervisory inspection and tamper-proof. A rotating file handler or standard database row does not satisfy this — records can be modified or deleted.
Trust Layer seals each record at creation with Ed25519 + RFC 3161 timestamp. The proof_id is independently verifiable at trust.arkforge.tech/verify without routing through ArkForge.
10 scans/day. No account required.
Unlimited scans + Art.31 register + Art.17-18 incident template.
All Pro + Trust Layer certification for supervisor-ready proof.
Add mcp.arkforge.tech/dora-mcp to Claude Desktop, Cursor, or Windsurf settings.
Ask Claude to classify your entity type and list all applicable DORA articles.
Scan your project for ICT gaps. Complete the organizational readiness assessment. Get your compliance score.
Generate your Art.31 ICT register and Art.17-18 incident template. Certify with Trust Layer for regulator-ready proof.
Start with the free scanner. Upgrade when you need the Art.31 register, incident template, or certified proof.