# `io.github.nimitt-IN/india-cyber-regulations` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.nimitt-IN/india-cyber-regulations
- JSON: https://anlyon.dev/api/v1/servers/io.github.nimitt-IN/india-cyber-regulations
- Version: 1.0.0 (active)
- Publisher: io.github.nimitt-IN (GitHub account)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T18:42:35.401Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Indian Cyber Regulation Register (BitScore)
Indian cyber regulation register and incident-reporting deadlines (India, US, EU), read at source.
```

Scanned 2026-10-21T19:30:35.886Z over streamable-http.

**9 tools: 5 change things and 4 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 5 | ask |
| Only reads | read | 4 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (5)

Creates or changes something that can be changed back. Claude Code: ask.

### `cyber_weather_today`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Today’s global cyber threat condition (Clear, Cloudy, Showers, Storm or Severe) from BitScore’s Cyber Weather, refreshed daily at 07:30 IST: points per instrument, CISA KEV additions, EPSS risers, outlook, patch calendar, outages and three actions. Each field names its source and licence. Indicative, not a measure of any organisation’s risk.
```

### `india_incident_reporting_deadlines`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Every incident-reporting clock an Indian entity owes — CERT-In six hours, the sectoral regulator (RBI, SEBI, IRDAI, IFSCA), SEBI LODR, NCIIPC, DPDP — each with its trigger, recipient, channel and source clause. Give noticed_at to get wall-clock IST due times. Clocks run in parallel; none discharges another.
```

### `india_threat_scorecard`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Aggregate counts of publicly observed cyber threat activity affecting Indian organisations, by industry vertical and category, for one edition (latest by default). Aggregate only: no organisation is named. A vertical the source did not cover is unmeasured, not zero.
```

### `sebi_cscrf_category`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Works out a SEBI regulated entity’s CSCRF category (MII, Qualified, Mid-size, Small-size, Self-certification or Exempt) from the current thresholds, and the obligations that category carries. Call with only entity_type to see which figures it needs. Boundary values the circulars leave uncategorised are reported as such, not guessed.
```

### `us_eu_incident_reporting_deadlines`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Incident-reporting clocks under SEC Form 8-K/6-K, NYDFS Part 500, the US bank 36-hour rule, HIPAA, the FTC Safeguards Rule, NIS2, DORA, GDPR and the EU Cyber Resilience Act, each from its own trigger. Give aware_at (and decided_at for materiality/classification clocks) for wall-clock due times.
```

## Only reads (4)

Looks things up and changes nothing. Claude Code: allow.

### `find_applicable_regulations`

- The name "find_applicable_regulations" says "find": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Given an Indian entity class, whether it is listed and whether it handles personal data, returns the cyber and data-protection instruments that bind it, why each applies, a caution where one is commonly misapplied, and its next dated deadline. RBI classes each map to their own 2026 Directions; RRBs and LABs have none, and the result says so.
```

### `find_global_cyber_regulations`

- The name "find_global_cyber_regulations" says "find": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
For an organisation operating across India, the US and the EU, lists the cyber and data-protection regimes that apply, may apply (check) or are pending, with why and a caution for each. All flags default to false and sizes/sectors to none.
```

### `get_instrument`

- The name "get_instrument" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Full register entry for one instrument by its id (from search_instruments): formal name, reference, issue date, status, who it binds, every dated deadline it sets, the regulator’s own URL and the date it was last re-read there.
```

### `search_instruments`

- The name "search_instruments" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search every cyber and data-protection instrument binding Indian regulated entities (RBI, SEBI, IRDAI, IFSCA, CERT-In, MeitY/DPDP): reference number, issue date, status, who it binds and the deadlines it sets. Filter by free text, issuer or status. Returns summaries; use get_instrument for one entry in full.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `india-cyber-regulations`:

```json
{
  "permissions": {
    "allow": [
      "mcp__india-cyber-regulations__search_instruments",
      "mcp__india-cyber-regulations__get_instrument",
      "mcp__india-cyber-regulations__find_applicable_regulations",
      "mcp__india-cyber-regulations__find_global_cyber_regulations"
    ],
    "ask": [
      "mcp__india-cyber-regulations__india_incident_reporting_deadlines",
      "mcp__india-cyber-regulations__us_eu_incident_reporting_deadlines",
      "mcp__india-cyber-regulations__sebi_cscrf_category",
      "mcp__india-cyber-regulations__india_threat_scorecard",
      "mcp__india-cyber-regulations__cyber_weather_today"
    ],
    "deny": []
  }
}
```