Fourteen Ansvar agent skills for EU security and compliance work.
Four standalone skills: STRIDE/LINDDUN regulatory threat modeling, incident-reporting navigation across NIS2/GDPR/DORA/CRA, CRA vulnerability obligations, and cited clause-level ISO standards support (ISO/IEC 27001, 27002, 27005, 42001, ISO/SAE 21434). Plus the Ansvar workflow skill library: using-ansvar for cited legal and standards questions, and family skills for gap analysis, threat modelling, DPIA and FRIA, TARA, tender
MCP connector Server URL https://gateway.ansvar.eu/mcpCopy Login OAuth Skills 14 in the Claude listing
Ansvar document review Review an uploaded document against a regulatory baseline, with every finding anchored to a paragraph-level citation and a content hash. Ansvar dpia GDPR Article 35 data protection impact assessments and EU AI Act Article 27 fundamental rights impact assessments, with the national Article 35(4) lists and the Charter rights in scope. Ansvar drone operations A SORA determination chain for a specific-category UAS operation: ground and air risk, SAIL, the applicable operational safety objectives with robustness levels, and containment. Ansvar gap analysis Assess an organisation against a regulatory framework control by control, with article-level citations and a coverage score. Ansvar tabletop A crisis simulation run turn by turn against a scripted adversary, scored from the decisions the team actually made, with an after-action report. Ansvar tara Structured risk assessments with likelihood and consequence bands, scored against declared thresholds and closed with treatments — including automotive, rail, robotics and OT TARA. Ansvar tender review Bidder-side completeness review of a public tender, and buyer-side lawfulness audit of the tender itself, each requirement cited to its legal basis. Ansvar threat model STRIDE security threat models and LINDDUN privacy threat models over a described system, with scored threats and mapped controls. Ansvar vulnerability decisions Contextual scoring of an already-scanned finding set with KEV and EPSS, a costed control-investment plan, deferral records for what stays open, and a merged CycloneDX VEX. Cra vulnerability obligations Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Incident reporting navigator Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2 Iso standards expert Use when a user asks what ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005, ISO/IEC 42001, or ISO/SAE 21434 requires — an ISMS clause, a control's guidance text, a risk-management step, an AI-management-sy Regulatory threat model Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a depe Using ansvar Use for every question about what a law, regulation, directive, or security standard says, requires, or means — GDPR, NIS2, DORA, the Cyber Resilience Act, the EU AI Act, national law across Europe, p 
Vanta#199