In a real incident the classification is the easy part and the deadlines are what hurt — different regimes, different windows, all counting from the moment you noticed. Getting them enumerated together at classification time is worth more than any single regime's guidance, because the failure mode is missing one you did not think applied. Use it to triage under pressure; the attestation is what you keep afterwards.
An incident-reporting MCP server for the case where one event triggers several regimes at once. It classifies the incident, then reports the reporting deadlines each applicable regime imposes, so the question "who do we have to tell, and by when" is answered in one pass rather than four.
- An incident classified against the regimes that could apply — EU AI Act Article 73, DORA, NIS2, GDPR breach — rather than assessed one regulation at a time — `classify_incident`
- Every reporting clock the classification starts, listed together, which is the whole point of the five-clock broadcast — `list_regime_clocks`
- A signed attestation of your incident response, for the file an auditor or regulator will ask to see — `sign_incident_response_attestation`
- Escalation workflows, an audit trail, and regulatory submission support around those three
No key on the free tier, which allows 10 calls a day. Launch with `uvx ai-incident-reporting-mcp` over stdio, or `pip install ai-incident-reporting-mcp` and run the command; the package is `ai-incident-reporting-mcp` (1.1.8 in pyproject and server.json). A Smithery installer is available for Claude Desktop. Signed attestations produce a certificate with a public verify URL, so the recipient checks it without contacting the vendor.
One command — pip install ai_incident_reporting_mcp