frag.hugo MCP
An official MCP server by frag.hugo that allows AI assistants like Claude, ChatGPT, and Copilot to interact with the frag.hugo GDPR and IT security platform. It enables users to fill in privacy documentation (VVT, TOMs, DSFA), check deadlines, search for fines, and manage security profiles via conversation, with actions reviewed by a data protection officer.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
Without an account Free, no sign-inWith your frag.hugo accountsign in at frag.hugo once
MCP endpoint (Streamable HTTP)
https://mcp.fraghugo.de/mcpWhat its tools do
14 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.
Read-only (9)
Checks and signals
Each line is separate evidence, not a trust score.
- Passed Endpoint answered the live check ·
- Passed Official MCP Registry namespace is tied to fraghugo.de ·
- Passed Endpoint is on the registry namespace domain ·
- Availability 1 of 1 checks passed in 30 days
What you can do with it
- Fill in privacy documentation like VVT and TOMs via conversation
- Check GDPR fines, deadlines, and supervisory authorities
- Manage employee training and safety briefings
- Register AI systems and NIS2 assessments
Source and maintenance
Vendor evidenceRegistry 1.0.0
- Maintenance checked
Protocol and capabilities
- Server
- frag.hugo 1.0.0
- MCP protocol negotiated in check
- 2025-11-25
- Tools
- 14 advertised
- Resources
- Not advertised
- Resource templates
- Not advertised
- Prompts
- Not advertised
Server-advertised capabilities
{
"tools": {
"listChanged": true
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
14 advertised
search_gdpr_fines — Search GDPR fines (DSGVO-Bußgelder)
Advertised read-only
Searches the frag.hugo database of documented GDPR fines (Germany and Europe), each case with authority, amount, GDPR articles, a short summary and the official source. Use it for questions such as "which fines were imposed for Art. 32" or "fines against telecom companies in Germany". Not for legal advice in an individual case and not for fines under other laws. Results are sorted by date, newest first.
search_gdpr_fines input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"bis": {
"type": "integer",
"maximum": 2100,
"minimum": 2018,
"description": "To year (inclusive)"
},
"von": {
"type": "integer",
"maximum": 2100,
"minimum": 2018,
"description": "From year (inclusive)"
},
"land": {
"type": "string",
"pattern": "^[A-Za-z]{2}$",
"description": "Country, ISO 3166-1 alpha-2, e.g. DE, IE, FR"
},
"limit": {
"type": "integer",
"default": 10,
"maximum": 20,
"minimum": 1,
"description": "Number of results, 1–20 (default 10)"
},
"suche": {
"type": "string",
"maxLength": 100,
"minLength": 1,
"description": "Free text: company, facts, authority (max. 100 chars)"
},
"artikel": {
"type": "string",
"maxLength": 30,
"minLength": 1,
"description": "GDPR article, e.g. \"Art. 32\" or \"32\""
},
"branche": {
"type": "string",
"maxLength": 60,
"minLength": 2,
"description": "Industry (Branche), e.g. \"Telekommunikation\""
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"betrag_min": {
"type": "number",
"maximum": 10000000000,
"minimum": 0,
"description": "Minimum fine in EUR"
},
"bundesland": {
"type": "string",
"maxLength": 40,
"minLength": 2,
"description": "German federal state (Bundesland) or \"Bund\""
}
}
}search_gdpr_fines output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"stand",
"gesamt",
"treffer",
"quelle"
],
"properties": {
"stand": {
"type": "string"
},
"gesamt": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Total number of matching cases"
},
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"treffer": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"datum",
"behoerde",
"land",
"bundesland",
"unternehmen",
"branche",
"betrag_eur",
"artikel",
"sachverhalt",
"quelle_url",
"link"
],
"properties": {
"id": {
"type": "string"
},
"land": {
"type": "string"
},
"link": {
"type": "string",
"format": "uri"
},
"datum": {
"type": "string"
},
"artikel": {
"type": "array",
"items": {
"type": "string"
}
},
"branche": {
"type": [
"string",
"null"
]
},
"behoerde": {
"type": "string"
},
"betrag_eur": {
"type": "number"
},
"bundesland": {
"type": [
"string",
"null"
]
},
"quelle_url": {
"type": [
"string",
"null"
]
},
"sachverhalt": {
"type": "string",
"maxLength": 400
},
"unternehmen": {
"type": "string",
"description": "Company name or \"anonym\""
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}search_gdpr_fines annotations
{
"title": "Search GDPR fines (DSGVO-Bußgelder)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}get_compliance_deadlines — Compliance deadlines (Fristenkalender)
Advertised read-only
Lists dated compliance deadlines from the frag.hugo deadline calendar (GDPR, NIS2, AI Act, CRA, DORA, Data Act, accessibility act and more), each with legal provision, status, what to do and the official source. Without date filters it returns the next upcoming deadlines from today. Not for deadlines of an individual company (data breach, data subject request); those need an account.
get_compliance_deadlines input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"bis": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "To date (YYYY-MM-DD)"
},
"von": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "From date (YYYY-MM-DD). Default: today, unless \"status\" is set"
},
"limit": {
"type": "integer",
"default": 10,
"maximum": 30,
"minimum": 1,
"description": "Number of results, 1–30 (default 10)"
},
"gesetz": {
"enum": [
"dsgvo",
"dsgvo-durchsetzung",
"digital-omnibus",
"nis2",
"kritis-dach",
"ai-act",
"cra",
"dora",
"data-act",
"bfsg",
"e-rechnung",
"tdddg",
"hinschg",
"eidas",
"produkthaftung",
"gpsr",
"maschinen-vo",
"ehds",
"red",
"dsa",
"entgelttransparenz"
],
"type": "string",
"description": "Law (Gesetz) key, e.g. \"nis2\", \"ai-act\", \"dsgvo\""
},
"status": {
"enum": [
"in-kraft",
"kommt",
"verschoben",
"entwurf"
],
"type": "string",
"description": "in-kraft = in force, kommt = upcoming, verschoben = postponed, entwurf = draft"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"zielgruppe": {
"enum": [
"alle",
"kmu",
"nis2",
"kritis",
"hersteller",
"finanz",
"ki-anbieter",
"ki-betreiber",
"online-handel",
"oeffentlich",
"datenanbieter"
],
"type": "string",
"description": "Target group (Zielgruppe); deadlines for \"alle\" are always included"
}
}
}get_compliance_deadlines output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"stand",
"naechste_pruefung",
"gesamt",
"fristen",
"quelle"
],
"properties": {
"stand": {
"type": "string"
},
"gesamt": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"fristen": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"gesetz",
"titel",
"norm",
"datum",
"status",
"todo",
"quelle_url",
"link"
],
"properties": {
"id": {
"type": "string"
},
"link": {
"type": "string",
"format": "uri"
},
"norm": {
"type": "string"
},
"todo": {
"type": [
"string",
"null"
]
},
"datum": {
"type": "string"
},
"titel": {
"type": "string"
},
"gesetz": {
"type": "string"
},
"status": {
"type": "string"
},
"quelle_url": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"naechste_pruefung": {
"type": [
"string",
"null"
],
"description": "Date of the next scheduled review of the calendar"
}
},
"additionalProperties": false
}get_compliance_deadlines annotations
{
"title": "Compliance deadlines (Fristenkalender)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}check_software_gdpr — Check software for GDPR fitness (DSGVO-Prüfstand)
Advertised read-only
Looks up whether frag.hugo has reviewed a software or cloud service for GDPR use in companies (contract partner, data processing agreement, subprocessors, data location, third-country transfer, AI training, certificates, admin controls, deletion, data subject rights). Returns the published verdict with evidence links, or, if the service has not been reviewed, the ten criteria to check yourself. It never estimates a verdict for unreviewed services.
check_software_gdpr input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 80,
"minLength": 2,
"description": "Name of the software or cloud service, e.g. \"Canva\", \"ChatGPT\""
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
}
}
}check_software_gdpr output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"gesucht",
"dienst",
"hersteller",
"kurzurteil",
"urteil",
"geeigneter_tarif",
"ungeeignet",
"kriterien",
"kriterien_zum_selbst_pruefen",
"geprueft",
"naechste_pruefung",
"link",
"quelle"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"dienst": {
"type": [
"string",
"null"
],
"description": "Name of the reviewed service, if found"
},
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"status": {
"enum": [
"geprueft",
"geplant",
"nicht_geprueft"
],
"type": "string"
},
"urteil": {
"type": [
"string",
"null"
]
},
"gesucht": {
"type": "string"
},
"geprueft": {
"type": [
"string",
"null"
]
},
"kriterien": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"ampel",
"aussage",
"tarif_hinweis",
"beleg_urls"
],
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"ampel": {
"type": "string",
"description": "gruen | gelb | rot"
},
"aussage": {
"type": "string"
},
"beleg_urls": {
"type": "array",
"items": {
"type": "string"
}
},
"tarif_hinweis": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"hersteller": {
"type": [
"string",
"null"
]
},
"kurzurteil": {
"type": [
"string",
"null"
],
"description": "geeignet | mit-auflagen | ungeeignet (only if reviewed)"
},
"ungeeignet": {
"type": [
"string",
"null"
]
},
"geeigneter_tarif": {
"type": [
"string",
"null"
]
},
"naechste_pruefung": {
"type": [
"string",
"null"
]
},
"kriterien_zum_selbst_pruefen": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"frage",
"massstab"
],
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"frage": {
"type": "string"
},
"massstab": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}check_software_gdpr annotations
{
"title": "Check software for GDPR fitness (DSGVO-Prüfstand)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}get_subprocessor_changes — Subprocessor changes (Subprozessor-Monitor)
Advertised read-only
Shows the subprocessor lists of 17 widely used cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce, HubSpot, Stripe and others) as monitored daily by frag.hugo: date of the last change, number of entries, names and links to the official list and the data processing agreement. Use it to check whether a provider changed its subprocessors since a given date. Not for providers outside these 17.
get_subprocessor_changes input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"seit": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Only providers whose subprocessor list changed on or after this date (YYYY-MM-DD)"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"anbieter": {
"enum": [
"microsoft-365",
"google-workspace",
"google-cloud",
"aws",
"cloudflare",
"github",
"zapier",
"salesforce",
"hubspot",
"mailchimp",
"slack",
"zoom",
"zendesk",
"atlassian",
"asana",
"monday",
"stripe"
],
"type": "string",
"description": "Provider ID; without it all 17 monitored providers are listed"
}
}
}get_subprocessor_changes output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"stand",
"gesamt",
"anbieter",
"quelle"
],
"properties": {
"stand": {
"type": "string"
},
"gesamt": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"anbieter": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"hersteller",
"geprueft",
"pruefstatus",
"letzte_aenderung",
"eintraege",
"namen",
"namen_gesamt",
"hinweis",
"quelle_url",
"avv_url",
"link"
],
"properties": {
"id": {
"type": "string"
},
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"namen": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 50
},
"avv_url": {
"type": [
"string",
"null"
]
},
"hinweis": {
"type": [
"string",
"null"
]
},
"geprueft": {
"type": [
"string",
"null"
],
"description": "Time of the last automatic check"
},
"eintraege": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Number of entries, if the list is machine-readable"
},
"hersteller": {
"type": [
"string",
"null"
]
},
"quelle_url": {
"type": [
"string",
"null"
]
},
"pruefstatus": {
"type": [
"string",
"null"
]
},
"namen_gesamt": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"letzte_aenderung": {
"type": [
"string",
"null"
],
"description": "Date of the last detected change of the list"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}get_subprocessor_changes annotations
{
"title": "Subprocessor changes (Subprozessor-Monitor)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}find_supervisory_authority — Find data protection authority (Aufsichtsbehörde)
Advertised read-only
Finds the competent German data protection supervisory authority by federal state, postcode (PLZ) of the main establishment or authority ID, with competence, website, key figures from the latest activity report (with evidence links), focus topics and notes for SMEs. In Bavaria, public bodies are supervised by BayLfD, companies by BayLDA. If a postcode spans two states, it asks back. Not for authorities outside Germany.
find_supervisory_authority input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"plz": {
"type": "string",
"pattern": "^\\d{5}$",
"description": "German postcode (PLZ) of the main establishment, 5 digits"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"bundesland": {
"type": "string",
"maxLength": 40,
"minLength": 2,
"description": "German federal state, name or code (e.g. \"Bayern\", \"BY\") or \"Bund\""
},
"behoerde_id": {
"enum": [
"bfdi",
"bw",
"bay-lda",
"bay-lfd",
"berlin",
"brandenburg",
"bremen",
"hamburg",
"hessen",
"mv",
"niedersachsen",
"nrw",
"rlp",
"saarland",
"sachsen",
"sachsen-anhalt",
"sh",
"thueringen"
],
"type": "string",
"description": "Authority ID from this tool"
},
"oeffentliche_stelle": {
"type": "boolean",
"default": false,
"description": "true for public bodies (only matters in Bavaria: BayLfD instead of BayLDA)"
}
}
}find_supervisory_authority output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"behoerde",
"rueckfrage",
"quelle"
],
"properties": {
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"status": {
"enum": [
"gefunden",
"rueckfrage",
"unbekannt"
],
"type": "string"
},
"behoerde": {
"anyOf": [
{
"type": "object",
"required": [
"id",
"name",
"kurzname",
"land",
"zustaendig",
"website",
"meldeweg",
"leitung",
"bericht",
"kennzahlen",
"schwerpunkte",
"kmu_hinweise",
"geprueft",
"link"
],
"properties": {
"id": {
"type": "string"
},
"land": {
"type": "string"
},
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"bericht": {
"anyOf": [
{
"type": "object",
"required": [
"nummer",
"berichtsjahr",
"url"
],
"properties": {
"url": {
"type": [
"string",
"null"
]
},
"nummer": {
"type": [
"string",
"null"
]
},
"berichtsjahr": {
"type": [
"number",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"leitung": {
"type": [
"string",
"null"
]
},
"website": {
"type": [
"string",
"null"
]
},
"geprueft": {
"type": [
"string",
"null"
]
},
"kurzname": {
"type": "string"
},
"meldeweg": {
"type": "object",
"required": [
"art",
"url",
"hinweis"
],
"properties": {
"art": {
"type": [
"string",
"null"
]
},
"url": {
"type": [
"string",
"null"
]
},
"hinweis": {
"type": "string"
}
},
"additionalProperties": false
},
"kennzahlen": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"wert",
"hinweis",
"beleg_url"
],
"properties": {
"name": {
"type": "string"
},
"wert": {
"type": "number"
},
"hinweis": {
"type": [
"string",
"null"
]
},
"beleg_url": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"zustaendig": {
"type": [
"string",
"null"
]
},
"kmu_hinweise": {
"type": "array",
"items": {
"type": "string"
}
},
"schwerpunkte": {
"type": "array",
"items": {
"type": "object",
"required": [
"titel",
"text",
"beleg_url"
],
"properties": {
"text": {
"type": "string"
},
"titel": {
"type": "string"
},
"beleg_url": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"rueckfrage": {
"anyOf": [
{
"type": "object",
"required": [
"frage",
"laender"
],
"properties": {
"frage": {
"type": "string"
},
"laender": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
}
},
"additionalProperties": false
}find_supervisory_authority annotations
{
"title": "Find data protection authority (Aufsichtsbehörde)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}get_cyber_threat_picture — Ransomware situation Germany (Cyber-Lagebild)
Advertised read-only
Summarises how many organisations from Germany ransomware groups have named on their leak sites in the last 30 days or 12 months, by industry and group, with the frag.hugo monthly assessment and method. Counts are perpetrator claims from the RansomLook inventory (CIRCL, CC BY 4.0), not confirmed incidents. Not for looking up individual victims.
get_cyber_threat_picture input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"branche": {
"type": "string",
"maxLength": 60,
"minLength": 2,
"description": "Industry (Branche), e.g. \"Industrie\", \"Gesundheitswesen\""
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"zeitraum": {
"enum": [
"30t",
"12m"
],
"type": "string",
"default": "30t",
"description": "30t = last 30 days, 12m = last 12 months (default 30t)"
}
}
}get_cyber_threat_picture output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"stand",
"zeitraum",
"kennzahlen",
"branche",
"branchen",
"gruppen",
"einordnung",
"methodik",
"datenquelle",
"hinweis",
"quelle"
],
"properties": {
"stand": {
"type": "string"
},
"quelle": {
"type": "object",
"required": [
"name",
"herausgeber",
"stand",
"link",
"nutzung",
"rueckfall"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"stand": {
"type": "string"
},
"hinweis": {
"type": "string"
},
"nutzung": {
"type": "string"
},
"rueckfall": {
"type": "boolean",
"description": "true = live export unreachable, last good copy served"
},
"herausgeber": {
"type": "string"
}
},
"additionalProperties": false
},
"branche": {
"anyOf": [
{
"type": "object",
"required": [
"gesucht",
"treffer",
"faelle"
],
"properties": {
"faelle": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"gesucht": {
"type": "string"
},
"treffer": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"anzahl"
],
"properties": {
"name": {
"type": "string"
},
"anzahl": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"gruppen": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"anzahl"
],
"properties": {
"name": {
"type": "string"
},
"anzahl": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
}
},
"additionalProperties": false
}
},
"hinweis": {
"type": "string"
},
"branchen": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"anzahl",
"vorjahr"
],
"properties": {
"name": {
"type": "string"
},
"anzahl": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"vorjahr": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
]
}
},
"additionalProperties": false
}
},
"methodik": {
"type": "string"
},
"zeitraum": {
"enum": [
"30t",
"12m"
],
"type": "string"
},
"einordnung": {
"anyOf": [
{
"type": "object",
"required": [
"monat",
"titel",
"kernaussage"
],
"properties": {
"monat": {
"type": "string"
},
"titel": {
"type": "string"
},
"kernaussage": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"kennzahlen": {
"type": "object",
"required": [
"faelle",
"vorperiode",
"veraenderung_prozent",
"gruppen",
"pro_woche"
],
"properties": {
"faelle": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Victims from Germany named on leak sites in the period"
},
"gruppen": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"pro_woche": {
"type": [
"number",
"null"
]
},
"vorperiode": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"veraenderung_prozent": {
"type": [
"number",
"null"
]
}
},
"additionalProperties": false
},
"datenquelle": {
"type": "object",
"required": [
"name",
"url",
"lizenz",
"lizenz_url"
],
"properties": {
"url": {
"type": "string"
},
"name": {
"type": "string"
},
"lizenz": {
"type": "string"
},
"lizenz_url": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}get_cyber_threat_picture annotations
{
"title": "Ransomware situation Germany (Cyber-Lagebild)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}check_email_security — Check email security of a domain (SPF, DKIM, DMARC)
Advertised read-onlyOpen-world
Checks the public DNS records that protect a domain against e-mail spoofing: SPF, DKIM (common selectors), DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Returns an overall assessment, one finding per check and recommendations. Use it for a company domain, not for single mailboxes. Nothing is stored. Rate limited per connection.
check_email_security input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 253,
"minLength": 3,
"description": "Public domain name, e.g. \"example.de\" (an e-mail address or URL is reduced to its domain)"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
}
}
}check_email_security output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain",
"hinweis",
"geprueft_am",
"anbieter",
"gesamt",
"pruefungen",
"empfehlungen",
"gespeichert",
"link"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"domain": {
"type": "string"
},
"gesamt": {
"type": "object",
"required": [
"stufe",
"satz",
"begruendung"
],
"properties": {
"satz": {
"type": "string"
},
"stufe": {
"type": "string"
},
"begruendung": {
"type": "string"
}
},
"additionalProperties": false
},
"hinweis": {
"type": [
"string",
"null"
]
},
"anbieter": {
"type": [
"string",
"null"
],
"description": "Detected mail provider, if any"
},
"pruefungen": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"titel",
"status",
"befund",
"details",
"empfehlung"
],
"properties": {
"id": {
"type": "string"
},
"titel": {
"type": "string"
},
"befund": {
"type": "string"
},
"status": {
"type": "string",
"description": "gut | warnung | kritisch | fehlt | neutral"
},
"details": {
"type": "array",
"items": {
"type": "string"
}
},
"empfehlung": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"geprueft_am": {
"type": "string"
},
"gespeichert": {
"type": "boolean",
"const": false,
"description": "Nothing about this check is stored by frag.hugo"
},
"empfehlungen": {
"type": "array",
"items": {
"type": "object",
"required": [
"pruefung",
"empfehlung"
],
"properties": {
"pruefung": {
"type": "string"
},
"empfehlung": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}check_email_security annotations
{
"title": "Check email security of a domain (SPF, DKIM, DMARC)",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}start_website_check — Start website privacy check (Hugo Check)
Open-world
Starts the free frag.hugo website check (Hugo Check) for a public URL: cookies and tracking before consent, consent banner, Google Fonts, privacy policy and imprint, TLS and security headers, e-mail records, accessibility and shop duties. Returns the result directly if it is ready within about 20 seconds, otherwise a scan_id for get_website_check_result. The same URL within one hour returns the same scan. Limited to 3 new checks per hour per connection. Not legal advice.
start_website_check input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"maxLength": 2000,
"minLength": 4,
"description": "Public website address, http or https, e.g. \"https://www.example.de\""
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
}
}
}start_website_check output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"scan_id",
"url",
"wartezeit_s",
"ergebnis",
"link",
"wiederverwendet"
],
"properties": {
"url": {
"type": [
"string",
"null"
]
},
"link": {
"type": "string",
"format": "uri",
"description": "Full report in the browser on check.fraghugo.de (runs the check there again)"
},
"status": {
"enum": [
"fertig",
"laeuft",
"wartet",
"unbekannt"
],
"type": "string"
},
"scan_id": {
"type": "string"
},
"ergebnis": {
"anyOf": [
{
"type": "object",
"required": [
"gepruefte_url",
"geprueft_am",
"punkte",
"note",
"kategorien",
"wichtigste_befunde",
"hinweis"
],
"properties": {
"note": {
"type": "string"
},
"punkte": {
"type": "number",
"description": "Score 0–100 of the free check"
},
"hinweis": {
"type": [
"string",
"null"
]
},
"kategorien": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"status",
"pruefungen",
"rot",
"gelb"
],
"properties": {
"id": {
"type": "string"
},
"rot": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"gelb": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"name": {
"type": "string"
},
"status": {
"type": "string"
},
"pruefungen": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
}
},
"additionalProperties": false
}
},
"geprueft_am": {
"type": "string"
},
"gepruefte_url": {
"type": "string"
},
"wichtigste_befunde": {
"type": "array",
"items": {
"type": "object",
"required": [
"pruefung",
"kategorie",
"status",
"titel",
"zusammenfassung",
"empfehlung"
],
"properties": {
"titel": {
"type": "string"
},
"status": {
"type": "string",
"description": "rot | gelb"
},
"pruefung": {
"type": "string"
},
"kategorie": {
"type": "string"
},
"empfehlung": {
"type": [
"string",
"null"
]
},
"zusammenfassung": {
"type": "string"
}
},
"additionalProperties": false
},
"maxItems": 8
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"wartezeit_s": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
]
},
"wiederverwendet": {
"type": "boolean",
"description": "true = same URL was checked within the last hour; that scan is returned"
}
},
"additionalProperties": false
}start_website_check annotations
{
"title": "Start website privacy check (Hugo Check)",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}get_website_check_result — Get website check result (Hugo Check)
Advertised read-onlyOpen-world
Returns the result of a website check started with start_website_check: status per category and up to eight most important findings with explanation, or "still running". Only scans started through this connector within the last 24 hours can be fetched.
get_website_check_result input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"scan_id"
],
"properties": {
"scan_id": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
"description": "scan_id returned by start_website_check"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
}
}
}get_website_check_result output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"scan_id",
"url",
"wartezeit_s",
"ergebnis",
"link"
],
"properties": {
"url": {
"type": [
"string",
"null"
]
},
"link": {
"type": "string",
"format": "uri",
"description": "Full report in the browser on check.fraghugo.de (runs the check there again)"
},
"status": {
"enum": [
"fertig",
"laeuft",
"wartet",
"unbekannt"
],
"type": "string"
},
"scan_id": {
"type": "string"
},
"ergebnis": {
"anyOf": [
{
"type": "object",
"required": [
"gepruefte_url",
"geprueft_am",
"punkte",
"note",
"kategorien",
"wichtigste_befunde",
"hinweis"
],
"properties": {
"note": {
"type": "string"
},
"punkte": {
"type": "number",
"description": "Score 0–100 of the free check"
},
"hinweis": {
"type": [
"string",
"null"
]
},
"kategorien": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"status",
"pruefungen",
"rot",
"gelb"
],
"properties": {
"id": {
"type": "string"
},
"rot": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"gelb": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
"name": {
"type": "string"
},
"status": {
"type": "string"
},
"pruefungen": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
}
},
"additionalProperties": false
}
},
"geprueft_am": {
"type": "string"
},
"gepruefte_url": {
"type": "string"
},
"wichtigste_befunde": {
"type": "array",
"items": {
"type": "object",
"required": [
"pruefung",
"kategorie",
"status",
"titel",
"zusammenfassung",
"empfehlung"
],
"properties": {
"titel": {
"type": "string"
},
"status": {
"type": "string",
"description": "rot | gelb"
},
"pruefung": {
"type": "string"
},
"kategorie": {
"type": "string"
},
"empfehlung": {
"type": [
"string",
"null"
]
},
"zusammenfassung": {
"type": "string"
}
},
"additionalProperties": false
},
"maxItems": 8
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"wartezeit_s": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
]
}
},
"additionalProperties": false
}get_website_check_result annotations
{
"title": "Get website check result (Hugo Check)",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}vendor_profile — Vendor due-diligence profile (Lieferanten-Steckbrief)
Open-world
Collects what frag.hugo publishes about a vendor for a due-diligence note: e-mail security of its domain, the GDPR review verdict if one exists, the subprocessor monitor entry, documented GDPR fines matched by company name, incidents published on fraghugo.de, and optionally a website check. It gives no overall grade and does not judge the vendor; each item carries its own source. Use the company name for better fine matching.
vendor_profile input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 253,
"minLength": 3,
"description": "Main domain of the vendor, e.g. \"stripe.com\""
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"firmenname": {
"type": "string",
"maxLength": 120,
"minLength": 2,
"description": "Company name (Firmenname) for matching fines and incidents"
},
"website_pruefen": {
"type": "boolean",
"default": false,
"description": "Also start a website check (Hugo Check) of the domain; counts against its hourly limit"
}
}
}vendor_profile output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain",
"firmenname",
"mail_sicherheit",
"pruefstand",
"subprozessor_monitor",
"bussgelder",
"lagebild",
"website_check",
"gesamtnote",
"quellen_stand"
],
"properties": {
"domain": {
"type": "string"
},
"lagebild": {
"type": "array",
"items": {
"type": "object",
"required": [
"datum",
"organisation",
"was",
"quelle_medium",
"quelle_url"
],
"properties": {
"was": {
"type": "string"
},
"datum": {
"type": "string"
},
"quelle_url": {
"type": [
"string",
"null"
]
},
"organisation": {
"type": "string"
},
"quelle_medium": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"bussgelder": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"datum",
"unternehmen",
"behoerde",
"betrag_eur",
"artikel",
"quelle_url",
"link"
],
"properties": {
"id": {
"type": "string"
},
"link": {
"type": "string"
},
"datum": {
"type": "string"
},
"artikel": {
"type": "array",
"items": {
"type": "string"
}
},
"behoerde": {
"type": "string"
},
"betrag_eur": {
"type": [
"number",
"null"
]
},
"quelle_url": {
"type": [
"string",
"null"
]
},
"unternehmen": {
"type": "string"
}
},
"additionalProperties": false
}
},
"firmenname": {
"type": [
"string",
"null"
]
},
"gesamtnote": {
"type": "null",
"description": "Deliberately none: each line stands with its own source"
},
"pruefstand": {
"anyOf": [
{
"type": "object",
"required": [
"dienst",
"hersteller",
"kurzurteil",
"geprueft",
"link"
],
"properties": {
"link": {
"type": "string"
},
"dienst": {
"type": "string"
},
"geprueft": {
"type": [
"string",
"null"
]
},
"hersteller": {
"type": [
"string",
"null"
]
},
"kurzurteil": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"quellen_stand": {
"type": "object",
"description": "As-of date per data export used",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "string"
}
},
"website_check": {
"anyOf": [
{
"anyOf": [
{
"type": "object",
"required": [
"scan_id",
"wiederverwendet",
"link"
],
"properties": {
"link": {
"type": "string"
},
"scan_id": {
"type": "string"
},
"wiederverwendet": {
"type": "boolean"
}
},
"additionalProperties": false
},
{
"type": "object",
"required": [
"status",
"grund"
],
"properties": {
"grund": {
"type": "string"
},
"status": {
"type": "string",
"const": "nicht_verfuegbar"
}
},
"additionalProperties": false
}
]
},
{
"type": "null"
}
]
},
"mail_sicherheit": {
"anyOf": [
{
"type": "object",
"required": [
"domain",
"hinweis",
"geprueft_am",
"anbieter",
"gesamt",
"pruefungen",
"empfehlungen",
"gespeichert",
"link"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"domain": {
"type": "string"
},
"gesamt": {
"type": "object",
"required": [
"stufe",
"satz",
"begruendung"
],
"properties": {
"satz": {
"type": "string"
},
"stufe": {
"type": "string"
},
"begruendung": {
"type": "string"
}
},
"additionalProperties": false
},
"hinweis": {
"type": [
"string",
"null"
]
},
"anbieter": {
"type": [
"string",
"null"
],
"description": "Detected mail provider, if any"
},
"pruefungen": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"titel",
"status",
"befund",
"details",
"empfehlung"
],
"properties": {
"id": {
"type": "string"
},
"titel": {
"type": "string"
},
"befund": {
"type": "string"
},
"status": {
"type": "string",
"description": "gut | warnung | kritisch | fehlt | neutral"
},
"details": {
"type": "array",
"items": {
"type": "string"
}
},
"empfehlung": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
"geprueft_am": {
"type": "string"
},
"gespeichert": {
"type": "boolean",
"const": false,
"description": "Nothing about this check is stored by frag.hugo"
},
"empfehlungen": {
"type": "array",
"items": {
"type": "object",
"required": [
"pruefung",
"empfehlung"
],
"properties": {
"pruefung": {
"type": "string"
},
"empfehlung": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
{
"type": "object",
"required": [
"status",
"grund"
],
"properties": {
"grund": {
"type": "string"
},
"status": {
"type": "string",
"const": "nicht_verfuegbar"
}
},
"additionalProperties": false
}
]
},
"subprozessor_monitor": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"name",
"letzte_aenderung",
"quelle_url",
"avv_url",
"link"
],
"properties": {
"id": {
"type": "string"
},
"link": {
"type": "string"
},
"name": {
"type": "string"
},
"avv_url": {
"type": [
"string",
"null"
]
},
"quelle_url": {
"type": [
"string",
"null"
]
},
"letzte_aenderung": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}vendor_profile annotations
{
"title": "Vendor due-diligence profile (Lieferanten-Steckbrief)",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}my_privacy_deadlines — My open privacy deadlines (Fristen meiner Firma)
Advertised read-only
Lists the open data protection deadlines of the organisation connected to this frag.hugo account: data breaches with their 72-hour reporting deadline (Art. 33 GDPR), data subject requests with their one-month deadline (Art. 12(3) GDPR, incl. extensions) and records of processing or processor agreements waiting for review by the data protection officer. Returns type, deadline, status and an app link per entry — no descriptions, names or contact details. Requires a connected frag.hugo account. Not for deadlines of laws in general (use get_compliance_deadlines).
my_privacy_deadlines input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"art": {
"enum": [
"datenpannen",
"anfragen",
"freigaben",
"alle"
],
"type": "string",
"default": "alle",
"description": "Which deadlines: data breaches (72 h), data subject requests (one month), entries awaiting DPO review, or all"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
}
}
}my_privacy_deadlines output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"organisation",
"datenpannen",
"anfragen",
"freigaben",
"ohne_recht",
"link"
],
"properties": {
"link": {
"type": "string",
"format": "uri"
},
"anfragen": {
"anyOf": [
{
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"art",
"eingegangen_am",
"frist",
"verlaengert",
"status",
"ueberfaellig",
"app_link"
],
"properties": {
"id": {
"type": "string"
},
"art": {
"type": "string"
},
"frist": {
"type": "string"
},
"status": {
"type": "string"
},
"app_link": {
"type": "string",
"format": "uri"
},
"verlaengert": {
"type": "boolean"
},
"ueberfaellig": {
"type": "boolean"
},
"eingegangen_am": {
"type": "string"
}
},
"additionalProperties": false
}
},
{
"type": "null"
}
]
},
"freigaben": {
"anyOf": [
{
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"art",
"eingereicht_am",
"status",
"app_link"
],
"properties": {
"id": {
"type": "string"
},
"art": {
"enum": [
"vvt",
"avv"
],
"type": "string"
},
"status": {
"type": "string"
},
"app_link": {
"type": "string",
"format": "uri"
},
"eingereicht_am": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
},
{
"type": "null"
}
]
},
"ohne_recht": {
"type": "array",
"items": {
"enum": [
"datenpannen",
"anfragen",
"freigaben"
],
"type": "string"
}
},
"datenpannen": {
"anyOf": [
{
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"frist",
"entdeckt_am",
"status",
"risiko",
"fertiggestellt",
"ueberfaellig",
"app_link"
],
"properties": {
"id": {
"type": "string"
},
"frist": {
"type": "string"
},
"risiko": {
"type": "string"
},
"status": {
"type": "string"
},
"app_link": {
"type": "string",
"format": "uri"
},
"entdeckt_am": {
"type": "string"
},
"ueberfaellig": {
"type": "boolean"
},
"fertiggestellt": {
"type": "boolean"
}
},
"additionalProperties": false
}
},
{
"type": "null"
}
],
"description": "null = not requested or no permission"
},
"organisation": {
"type": "string",
"description": "Organisation bound to this connection"
}
},
"additionalProperties": false
}my_privacy_deadlines annotations
{
"title": "My open privacy deadlines (Fristen meiner Firma)",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}report_data_breach — Report a data breach (Datenpanne, Art. 33 GDPR)
Advertised destructive
Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without `bestaetigung`): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.
report_data_breach input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"beschreibung",
"entdeckt_am",
"vorfall_typ",
"risiko"
],
"properties": {
"risiko": {
"enum": [
"kein_risiko",
"risiko",
"hohes_risiko",
"unklar"
],
"type": "string",
"description": "Risk to the rights and freedoms of persons as assessed by the organisation; \"unklar\" if not yet assessed"
},
"uebung": {
"type": "boolean",
"default": false,
"description": "true = practice case (drill): no deadline reminders, no notifications"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"massnahmen": {
"type": "string",
"maxLength": 4000,
"description": "Measures already taken"
},
"entdeckt_am": {
"type": "string",
"format": "date-time",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
"description": "When the organisation became aware of the breach, ISO 8601 with time zone (e.g. 2026-10-28T09:30:00+01:00). Starts the 72-hour deadline. Not in the future."
},
"vorfall_typ": {
"type": "array",
"items": {
"enum": [
"fehlversand",
"verlust_diebstahl",
"cyberangriff",
"schadsoftware",
"phishing",
"unbefugter_zugriff_intern",
"veroeffentlichung",
"fehlkonfiguration",
"entsorgung",
"auftragsverarbeiter",
"sonstiges"
],
"type": "string"
},
"maxItems": 5,
"minItems": 1,
"description": "Type(s) of incident"
},
"beschreibung": {
"type": "string",
"maxLength": 4000,
"minLength": 20,
"description": "What happened, in plain words (20–4,000 characters). Avoid names of affected persons."
},
"bestaetigung": {
"type": "string",
"maxLength": 120,
"description": "Value from the preview. Omit it to get the preview; send it unchanged to create the breach."
},
"anzahl_unbekannt": {
"type": "boolean",
"default": false,
"description": "true if the number of affected persons is not yet known"
},
"betroffene_daten": {
"type": "array",
"items": {
"enum": [
"name",
"email",
"adresse",
"telefon",
"geburtsdatum",
"bankdaten",
"kreditkarte",
"sozialversicherung",
"personalausweis",
"zugangsdaten",
"standort",
"fotos",
"versicherung",
"gesundheit",
"ethnische_herkunft",
"politische_meinung",
"religion",
"gewerkschaft",
"genetisch",
"biometrisch",
"sexualleben",
"straftaten",
"berufsgeheimnis",
"steuer_sozialgeheimnis",
"sonstiges",
"unbekannt"
],
"type": "string"
},
"default": [],
"maxItems": 20,
"description": "Categories of personal data affected"
},
"anzahl_betroffene": {
"type": "integer",
"maximum": 100000000,
"minimum": 1,
"description": "Approximate number of affected persons"
},
"kategorien_personen": {
"type": "array",
"items": {
"enum": [
"beschaeftigte",
"bewerber",
"kunden",
"interessenten",
"nutzer",
"patienten",
"schueler_studierende",
"kinder",
"schutzbeduerftige",
"eltern",
"oeffentliche_personen",
"lieferanten",
"unbekannt",
"sonstige"
],
"type": "string"
},
"default": [],
"maxItems": 14,
"description": "Categories of data subjects"
}
}
}report_data_breach output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"schritt",
"frist",
"uebung"
],
"properties": {
"frist": {
"type": "string",
"description": "End of the 72-hour reporting deadline (UTC)"
},
"felder": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"uebung": {
"type": "boolean"
},
"schritt": {
"enum": [
"vorschau",
"angelegt"
],
"type": "string"
},
"app_link": {
"type": "string",
"format": "uri"
},
"meldeweg": {
"anyOf": [
{
"type": "object",
"required": [
"art",
"url",
"formular_url",
"email",
"hinweise"
],
"properties": {
"art": {
"type": "string"
},
"url": {
"type": "string"
},
"email": {
"type": [
"string",
"null"
]
},
"hinweise": {
"type": "array",
"items": {
"type": "string"
}
},
"formular_url": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"breach_id": {
"type": "string"
},
"wiederholt": {
"type": "boolean"
},
"gueltig_bis": {
"type": "string"
},
"bestaetigung": {
"type": "string"
},
"benachrichtigt": {
"type": "array",
"items": {
"type": "string"
}
},
"entwurf_meldung": {
"type": "string",
"description": "Draft for the report under Art. 33(3) GDPR, in the order of the authority form"
},
"behoerde_freitext": {
"type": [
"string",
"null"
]
},
"wird_benachrichtigt": {
"type": "array",
"items": {
"type": "string"
}
},
"zustaendige_behoerde": {
"anyOf": [
{
"type": "object",
"required": [
"id",
"name",
"kurzname",
"website"
],
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"website": {
"type": "string"
},
"kurzname": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"fehlende_pflichtfelder_der_behoerde": {
"type": "array",
"items": {
"type": "object",
"required": [
"feld",
"label",
"grund"
],
"properties": {
"feld": {
"type": "string"
},
"grund": {
"type": "string"
},
"label": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}report_data_breach annotations
{
"title": "Report a data breach (Datenpanne, Art. 33 GDPR)",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}create_data_subject_request — Log a data subject request (Betroffenenanfrage, Art. 15–22 GDPR)
Advertised destructive
Logs a data subject request (access, erasure, rectification, restriction, portability, objection) in the connected frag.hugo account and calculates the one-month deadline of Art. 12(3) GDPR. Step 1 (without `bestaetigung`): preview with the deadline, the possible extension, a note on identity verification and a reply draft from the frag.hugo templates, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the request; the data protection officer on file is notified. It does not send anything to the requesting person. Use only for requests addressed to the user’s own organisation.
create_data_subject_request input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"art",
"eingegangen_am",
"name",
"kontakt",
"kanal"
],
"properties": {
"art": {
"enum": [
"auskunft",
"loeschung",
"berichtigung",
"einschraenkung",
"datenportabilitaet",
"widerspruch"
],
"type": "string",
"description": "Type of request: access (Art. 15), erasure (17), rectification (16), restriction (18), portability (20), objection (21)"
},
"name": {
"type": "string",
"maxLength": 120,
"minLength": 1,
"description": "Name of the requesting person as given in the request"
},
"kanal": {
"enum": [
"email",
"post",
"telefon",
"sonstiges"
],
"type": "string",
"description": "How the request arrived"
},
"kontakt": {
"type": "string",
"maxLength": 200,
"minLength": 3,
"description": "E-mail address or postal address for the reply"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"beschreibung": {
"type": "string",
"maxLength": 2000,
"description": "What the person asks for, in short"
},
"bestaetigung": {
"type": "string",
"maxLength": 120,
"description": "Value from the preview. Omit it to get the preview; send it unchanged to log the request."
},
"eingegangen_am": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Date the request was received (YYYY-MM-DD). Starts the one-month deadline. Not in the future."
}
}
}create_data_subject_request output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"schritt",
"frist"
],
"properties": {
"frist": {
"type": "string",
"description": "Deadline for the answer (YYYY-MM-DD), one month from receipt"
},
"felder": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"dsar_id": {
"type": "string"
},
"schritt": {
"enum": [
"vorschau",
"angelegt"
],
"type": "string"
},
"app_link": {
"type": "string",
"format": "uri"
},
"wiederholt": {
"type": "boolean"
},
"gueltig_bis": {
"type": "string"
},
"bestaetigung": {
"type": "string"
},
"antwortentwurf": {
"anyOf": [
{
"type": "object",
"required": [
"titel",
"text"
],
"properties": {
"text": {
"type": "string"
},
"titel": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"benachrichtigt": {
"type": "array",
"items": {
"type": "string"
}
},
"wird_benachrichtigt": {
"type": "array",
"items": {
"type": "string"
}
},
"verlaengerung_moeglich": {
"type": "object",
"required": [
"bis",
"hinweis"
],
"properties": {
"bis": {
"type": "string"
},
"hinweis": {
"type": "string"
}
},
"additionalProperties": false
},
"identitaetspruefung_hinweis": {
"type": "string"
}
},
"additionalProperties": false
}create_data_subject_request annotations
{
"title": "Log a data subject request (Betroffenenanfrage, Art. 15–22 GDPR)",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}plan_software_introduction — Introduce new software (VVT entry and DPA review)
Advertised destructive
Prepares the data protection paperwork for introducing a new software or cloud service in the connected frag.hugo account. Step 1 (without `bestaetigung`): preview with the frag.hugo GDPR test result for the service (if reviewed), the matching template for the record of processing activities (Verarbeitungsverzeichnis) and what will be created, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates a record of processing entry and a processor agreement (AVV) entry, both submitted for review by the data protection officer. It does not approve the software and does not contact the vendor.
plan_software_introduction input schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"software",
"zweck"
],
"properties": {
"start": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Planned start (YYYY-MM-DD)"
},
"zweck": {
"type": "string",
"maxLength": 500,
"minLength": 10,
"description": "What the software will be used for"
},
"sprache": {
"enum": [
"de",
"en"
],
"type": "string",
"description": "Output language. Default: German if the input is German, otherwise English."
},
"anbieter": {
"type": "string",
"maxLength": 80,
"description": "Vendor, if known"
},
"software": {
"type": "string",
"maxLength": 80,
"minLength": 2,
"description": "Name of the software or cloud service (e.g. \"Slack\", \"HubSpot\")"
},
"betroffene": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"default": [],
"maxItems": 20,
"description": "Groups of persons concerned (e.g. \"Beschäftigte\", \"Kunden\")"
},
"datenarten": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"default": [],
"maxItems": 20,
"description": "Kinds of personal data processed (e.g. \"Kontaktdaten\", \"Chatnachrichten\")"
},
"abteilungen": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"default": [],
"maxItems": 20,
"description": "Departments that will use it"
},
"vorlage_ref": {
"type": "string",
"pattern": "^VVT-NEW-\\d{3}$",
"description": "Choose one of the templates offered in the preview (`vvt_vorlage.ref` or one of `weitere`) if the purpose fits better"
},
"bestaetigung": {
"type": "string",
"maxLength": 120,
"description": "Value from the preview. Omit it to get the preview; send it unchanged to create the entries."
}
}
}plan_software_introduction output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"schritt"
],
"properties": {
"dsb": {
"type": [
"string",
"null"
]
},
"avv_id": {
"type": "string"
},
"felder": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"vvt_id": {
"type": "string"
},
"schritt": {
"enum": [
"vorschau",
"angelegt"
],
"type": "string"
},
"app_links": {
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"pruefstand": {
"anyOf": [
{
"type": "object",
"required": [
"name",
"kurzurteil",
"urteil",
"link"
],
"properties": {
"link": {
"type": "string"
},
"name": {
"type": "string"
},
"urteil": {
"type": [
"string",
"null"
]
},
"kurzurteil": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"wiederholt": {
"type": "boolean"
},
"gueltig_bis": {
"type": "string"
},
"vvt_vorlage": {
"anyOf": [
{
"type": "object",
"required": [
"id",
"ref",
"name",
"weitere"
],
"properties": {
"id": {
"type": "string"
},
"ref": {
"type": "string"
},
"name": {
"type": "string"
},
"weitere": {
"type": "array",
"items": {
"type": "object",
"required": [
"ref",
"name"
],
"properties": {
"ref": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"description": "Other templates for the same product; pass one as `vorlage_ref` to use it"
}
},
"additionalProperties": false
},
{
"type": "null"
}
]
},
"bestaetigung": {
"type": "string"
},
"wird_angelegt": {
"type": "array",
"items": {
"type": "string"
}
},
"benachrichtigt": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}plan_software_introduction annotations
{
"title": "Introduce new software (VVT entry and DPA review)",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}Prompts
Not advertised
Resources
Not advertised
90-day uptime
A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.
- 2026-11-09: 1 of 1 checks answered
30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 373 ms
- 95th percentile latency
- 373 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 373 ms · metadata changed · 14 tool(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
Claude Code configuration
claude mcp add --transport http frag-hugo-mcp https://mcp.fraghugo.de/mcpCodex
Codex configuration
codex mcp add frag-hugo-mcp --url https://mcp.fraghugo.de/mcpCursor
Cursor configuration
{
"mcpServers": {
"frag-hugo-mcp": {
"url": "https://mcp.fraghugo.de/mcp"
}
}
}Cline
Cline configuration
{
"mcpServers": {
"frag-hugo-mcp": {
"type": "streamableHttp",
"url": "https://mcp.fraghugo.de/mcp",
"disabled": false
}
}
}VS Code
VS Code configuration
{
"servers": {
"frag-hugo-mcp": {
"type": "http",
"url": "https://mcp.fraghugo.de/mcp"
}
}
}Gemini CLI
Gemini CLI configuration
gemini mcp add --transport http frag-hugo-mcp https://mcp.fraghugo.de/mcpClaude Desktop
Claude Desktop configuration
https://mcp.fraghugo.de/mcpWindsurf
Windsurf configuration
{
"mcpServers": {
"frag-hugo-mcp": {
"serverUrl": "https://mcp.fraghugo.de/mcp"
}
}
}Let your agent find its tools
Find servers like frag.hugo MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.
Other productivity and knowledge servers
Do you run frag.hugo MCP?
Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.